CVE-2025-14051: youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables
A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14051?
CVE-2025-14051 is classified as a high-severity vulnerability due to improper control of dynamically-identified variables.
How do I fix CVE-2025-14051?
To fix CVE-2025-14051, you should update the youlaitech youlai-mall software to the latest version that addresses this vulnerability.
What versions of youlaitech youlai-mall are affected by CVE-2025-14051?
CVE-2025-14051 affects youlaitech youlai-mall versions 1.0.0 through 2.0.0.
What functions are impacted by CVE-2025-14051?
CVE-2025-14051 impacts the functions getById, updateAddress, and deleteAddress in the /mall-ums/app-api/v1/addresses/ file.
What kind of attack can be executed due to CVE-2025-14051?
An attacker can execute manipulation that leads to improper control of dynamically-identified variables due to CVE-2025-14051.