CVE-2025-14051
youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 4, 2025
- Updated
- Dec 5, 2025
- Reserved
- Dec 4, 2025
Description
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
youlai-mallyoulaitech |
|
References
- VDB-334367 | youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variablesvdb-entrytechnical-description
- VDB-334367 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #694827 | youlai-mall latest Improper Control of Resource Identifiersthird-party-advisory
- Submit #694836 | youlai-mall latest Improper Control of Resource Identifiers (Duplicate)third-party-advisory
- Submit #694837 | youlai-mall latest Improper Control of Resource Identifiers (Duplicate)third-party-advisory
- https://github.com/Hwwg/cve/issues/18issue-tracking
- https://github.com/Hwwg/cve/issues/19exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.