CVE-2025-14085 youlaitech youlai-mall orders improper control of dynamically-identified variables

A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the argument orderId leads to improper control of dynamically-identified variables. Remote exploitation of the attack is possible. The exploi...

CVE-2025-14051

CVE-2025-14051 affects youlaitech youlai-mall versions 1.0.0 through 2.0.0. The vulnerability resides in the functions getById(), updateAddress(), and deleteAddress() in the file /mall-ums/app-api/v1/addresses/. Exploitation can be performed remotely, and public exploits have been published. Reme...