CVE-2025-15086
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A weakness has been identified in youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile in the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. The manipulation causes improper access controls. The attack may be initiated remotely, and the exploit has been made available to the public.
Risk Assessment
A remote attacker could exploit the vulnerability to gain unauthorized access to member data, potentially leading to privacy and security breaches.
Recommendation
Contact the vendor for a patch; until then, consider restricting access to the API or implementing additional access controls.
Other vulnerabilities in youlai-mall
See all- CVE-2025-15087Medium
A security vulnerability has been detected in youlai-mall 1.0.0/2.0.0 in the submitOrderPayment function of OrderController.java. Manipulation of the orderSn argument leads to improper authorization, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2025-15085Medium
A security flaw has been discovered in youlai-mall versions 1.0.0 and 2.0.0 affecting the deductBalance function in MemberController.java. The manipulation results in improper authorization and can be launched remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-15084Low
A vulnerability in youlaitech youlai-mall 1.0.0/2.0.0 in the orderService.payOrder function leads to improper access controls. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is publicly available and the vendor has not responded.
- CVE-2025-14052Medium
A vulnerability has been found in youlaitech youlai-mall versions 1.0.0 and 2.0.0. The function getMemberById in /mall-ums/app-api/v1/members/ is affected. Manipulation of the argument memberId leads to improper access controls. The attack can be carried out remotely and the exploit is public.
Original NVD description (English source)
A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS