CVE-2025-15086
youlaitech youlai-mall MemberController.java getMemberByMobile access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 25, 2025
- Updated
- Dec 29, 2025
- Reserved
- Dec 25, 2025
Description
A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
youlai-mallyoulaitech |
|
References
- VDB-338414 | youlaitech youlai-mall MemberController.java getMemberByMobile access controlvdb-entrytechnical-description
- VDB-338414 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #708176 | youlai-mall latest Improper Control of Resource Identifiersthird-party-advisory
- https://github.com/Hwwg/cve/issues/27exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.