CVE-2026-72528: Medium severity CREEMA Handmade Marketplace App - Creema vulnerability
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to access a specially crafted URL. No attacker authentication or privileges are required, but exploitation requires user interaction.
Who is exposed to phishing through this vulnerability?
Users of the Handmade Marketplace App - Creema may be exposed if they open an attacker-crafted URL. The attacker-controlled website can then be displayed inside the app, which may make phishing content appear more trustworthy.
What is the security impact?
The reported impact is integrity-related and is limited to phishing risk: an attacker can cause an external website to be shown within the app. No confidentiality or availability impact is stated in the provided data.