PT-2025-49244 · Youlaitech · Youlai-Mall

Huangweigang · Published 2025-12-05 · Updated 2025-12-11 · CVE-2025-14086

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions youlaitech youlai-mall versions 1.0.0 through 2.0.0

Description A flaw exists in youlaitech youlai-mall that allows for improper access controls. This is due to the manipulation of the openid argument within an unknown function located at the ''/app-api/v1/members/openid'' endpoint. The issue can be exploited remotely. The details of the exploit have been publicly released. The vendor was notified but did not respond.

Recommendations Versions prior to 1.0.0 and versions after 2.0.0 should be used. As a temporary workaround, restrict access to the ''/app-api/v1/members/openid'' endpoint. Avoid using the openid parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-14086

Affected Products

Youlai-Mall

References · 10

• 🔥 https://github.com/Hwwg/cve/issues/25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14086 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14086 · Vendor Advisory
• https://twitter.com/CVEnew/status/1996953137446350923 · Twitter Post
• https://vuldb.com/?id.334477 · Note
• https://vuldb.com/?submit.695945 · Note
• https://t.me/cveNotify/144883 · Telegram Post
• https://twitter.com/dailycve/status/1998943190435639454 · Twitter Post
• https://vuldb.com/?ctiid.334477 · Note
• https://t.me/CVEtracker/38930 · Telegram Post