CVE-2026-13514— Chess Play and Learn App com.chess AndroidManifest.xml backup
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 43
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Chess | Play and Learn App | 4.9.0 | affected |
4.9.1 | affected | ||
4.9.2 | affected | ||
4.9.3 | affected | ||
4.9.4 | affected | ||
4.9.5 | affected | ||
4.9.6 | affected | ||
4.9.7 | affected | ||
| … +35 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-13514
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Chess Play and Learn App com.chess AndroidManifest.xml backup
Source: NVD (National Vulnerability Database)
Vulnerability Description
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
将备份文件暴露给非授权控制范围
Source: NVD (National Vulnerability Database)
Vulnerability Title
Chess Play and Learn App 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Chess Play and Learn App是Chess公司的一款儿童学习与娱乐应用软件。 Chess Play and Learn App存在安全漏洞，该漏洞源于对文件AndroidManifest.xml的处理不当，导致备份文件暴露给未授权控制范围。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Chess | Play and Learn App | 4.9.0 | cpe:2.3:a:chess:play_and_learn_app:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-13514
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13514
请登录查看更多情报信息。
News Coverage for CVE-2026-13514 (1)
Vendor Pages for CVE-2026-13514 (1)
IV. Related Vulnerabilities
Same weakness: CWE-530
- CVE-2024-56462
IBM QRadar SIEM is vulnerable to using components with known - CVE-2026-2974
AliasVault App Backup aliasvault.xml backup - CVE-2020-36899
QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbit - CVE-2025-3773
Trellix System Information Reporter 安全漏洞 - CVE-2024-12330
WP Database Backup – Unlimited Database & Files Backup by Ba
V. Comments for CVE-2026-13514
No comments yet