CVE-2025-14051

youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables

LOW 2.1EPSS 0.5%

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected: youlaitech · youlai-mall
CVSS v4.0 VULDB: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 NVD: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1 VULDB: 6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 VULDB: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 0.47% chance of exploitation in the next 30 days, 40th percentile
Published: 2025-12-04
Updated: 2025-12-05

Proof-of-concept exploits (1)

Hwwg/cve/issues/19

CVE-2025-14051

Proof-of-concept exploits (1)

Security advisories

References

Related