CVE-2025-14016
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the delete function of the file /member/readHistory/delete. Manipulation of the argument ids leads to improper authorization. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely exploit the vulnerability to unauthorizedly delete read history, potentially leading to data loss or integrity compromise.
Recommendation
Update mall-swarm to a version later than 1.0.3 if available, or implement additional authorization checks for the delete function. Monitor public exploits and restrict access to the interface.
Other vulnerabilities in macrozheng mall-swarm
Original NVD description (English source)
A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS