SQL Injection

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. In the content provider of the download manager, there is a possible SQL injection due to improper input validation. This could lead to local information disclosure with no additi…CVE-2018-9493Google Inc. · 0.9% likely

   CWE-89

2. In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed.…CVE-2019-2211Google · 0.7% likely

   CWE-89

3. The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an applica…CVE-2018-14066Google · 0.4% likely

   CWE-89

4. In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional execution privileges needed. User interac…CVE-2019-2198Google · 0.4% likely

   CWE-89

5. In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not need…CVE-2019-2196Google · 0.4% likely

   CWE-89

6. An issue was discovered on Samsung mobile devices with P(9.0) software. The MemorySaver Content Provider allows SQL injection. The Samsung ID is SVE-2019-14365 (August 2019).CVE-2019-20576Google · 0.4% likely

   CWE-89

7. An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is time-based SQL injection in Contacts. The Samsung ID is SVE-2018-13452 (March 2019).CVE-2019-20613Google · 0.4% likely

   CWE-89

8. In MediaProvider, there is a possible permissions bypass due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User…CVE-2020-0344Google · 0.2% likely

   CWE-89

9. In MediaProvider, there is a possible permissions bypass due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User…CVE-2020-0352Google · 0.2% likely

   CWE-89

10. In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileg…CVE-2022-20518Google · CVSS 5.5 · 0.2% likely

    CWE-89

11. In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with no a…CVE-2022-20517Google · CVSS 5.5 · 0.2% likely

    CWE-89

12. In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privil…CVE-2022-42535Google · CVSS 5.5 · 0.2% likely

    CWE-89

13. SQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxCVE-2026-15829Google · CVSS 8.6 · 0.2% likely

    CWE-89

14. In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could lead to local escalation of privilege wit…CVE-2019-2195Google · 0.2% likely

    CWE-89

15. In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could lead to local information disclosure with…CVE-2023-35683Google · 0.2% likely

    CWE-89

16. An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Gear VR Service Content Provider. The Samsung ID is…CVE-2019-20591Google · 0.2% likely

    CWE-89

17. An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the RCS Content Provider. The Samsung IDs are SVE-2019-…CVE-2019-20573Google · 0.2% likely

    CWE-89

18. In query of SmsProvider.java and MmsSmsProvider.java, there is a possible permission bypass due to SQL injection. This could lead to local information disclosure with System execu…CVE-2020-0060Google · 0.2% likely

    CWE-89

19. An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Story Video Editor Content Provider. The Samsung ID…CVE-2019-20592Google · 0.2% likely

    CWE-89

20. An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Wi-Fi history Content Provider. The Samsung ID is S…CVE-2019-20574Google · 0.2% likely

    CWE-89

21. In MMSProvider, there is a possible read of protected data due to improper input validationSQL injection. This could lead to local information disclosure of sms/mms data with User…CVE-2022-20280Google · 0.2% likely

    CWE-89

22. In queryInternal of CallLogProvider.java, there is a possible access to voicemail information due to SQL injection. This could lead to local information disclosure with no additio…CVE-2022-20351Google · 0.1% likely

    CWE-89

23. In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges ne…CVE-2025-48650Google · CVSS 8.4 · 0.1% likely

    CWE-89

24. In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privilege with no additiona…CVE-2025-32327Google · CVSS 7.8 · 0.1% likely

    CWE-89

25. In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional executio…CVE-2026-0075Google · CVSS 7.8 · 0.1% likelycovered by CyberSIXT

    CWE-891 article

26. In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional exec…CVE-2025-48544Google · CVSS 7.8 · 0.1% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.