CVE-2025-14051

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-913
• CWE-914

• https://github.com/Hwwg/cve/issues/18Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Hwwg/cve/issues/19Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.334367Permissions Required, VDB Entry
• https://vuldb.com/?id.334367Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.694827Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.694836Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.694837Third Party Advisory, VDB Entry
• https://github.com/Hwwg/cve/issues/18Exploit, Issue Tracking, Third Party Advisory
• https://github.com/Hwwg/cve/issues/19Exploit, Issue Tracking, Third Party Advisory

Published

Dec 4, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14046An improper neutralization of input vulnerability was identi…6.1
• CVE-2025-14047The Registration, User Profile, Membership, Content Restrict…5.3
• CVE-2025-14048The SimplyConvert plugin for WordPress is vulnerable to Stor…4.4
• CVE-2025-14049The VikRentItems Flexible Rental Management System plugin fo…6.1
• CVE-2025-1405The Product Catalog Simple plugin for WordPress is vulnerabl…5.4
• CVE-2025-14050The Design Import/Export plugin for WordPress is vulnerable …4.9
• CVE-2025-14052A vulnerability has been found in youlaitech youlai-mall 1.0…6.5
• CVE-2025-14053The Wish To Go plugin for WordPress is vulnerable to Stored …6.4
• CVE-2025-14054The WC Builder – WooCommerce Page Builder for WPBakery plugi…4.4
• CVE-2025-14055An integer underflow vulnerability in Silicon Labs Secure NC…2.4
• CVE-2025-14056The Custom Post Type UI plugin for WordPress is vulnerable t…4.4
• CVE-2025-14057The Multi-column Tag Map plugin for WordPress is vulnerable …4.4