Vendor
OPPO
13 known vulnerabilities.
OPPO at a glance
- Last 12 months
- 4
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 1 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 2 | 0 |
Most common weaknesses
Products
13 results · Feed
-
High 8.3
Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
-
High 7.3
O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.
Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.
-
High 7.1
ColorOS Assistant Path Traversal Vulnerability
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
-
Medium 5.6
Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet
OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.
-
High 8.3
Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
-
High 7.4
OPPO Clone Phone uses weak WPA passphrase as only means of security
OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.
-
High 8.7
OPPO Store APP has a WebView component privilege escalation vulnerability.
In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.
-
High 8.7
OPPO Store app include remote account token hijacking and sensitive information leakage
In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.
-
Critical 9.1
OPPO Usercenter Credit sdk
In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.
-
High 7.4
A remote code execution vulnerability in the webview component of OPPO Store app.
A remote code execution vulnerability in the webview component of OPPO Store app.
-
High 7.4
A remote code execution vulnerability in the webview component
A remote code execution vulnerability in the webview component of OnePlus Store app.
-
High 7.4
Command Injection In OPPO Service
There is a command injection problem in the old version of the mobile phone backup app.
-
Unscored —
In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger s…