CVE-2025-2089

A vulnerability has been found in StarSea99 starsea-mall 1.0/2.X and classified as critical. Affected by this vulnerability is the function updateUserInfo of the file /personal/updateInfo of the component com.siro.mall.controller.mall.UserController. The manipulation of the argument userId leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-266
• CWE-284

• https://vuldb.com/?ctiid.298903Permissions Required, VDB Entry
• https://vuldb.com/?id.298903Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.514977Third Party Advisory, VDB Entry
• https://wiki.shikangsi.com/post/share/baecf028-1116-4600-ae9c-f655cc93c29bExploit, Third Party Advisory
• https://wiki.shikangsi.com/post/share/baecf028-1116-4600-ae9c-f655cc93c29bExploit, Third Party Advisory

Published

Mar 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-20884Improper access control in Samsung Message prior to SMR Jan-…4.6
• CVE-2025-20885Out-of-bounds write in softsim trustlet prior to SMR Jan-202…6.7
• CVE-2025-20886Inclusion of sensitive information in test code in softsim t…4.4
• CVE-2025-20887Out-of-bounds read in accessing table used for svp8t in libs…5.5
• CVE-2025-20888Out-of-bounds write in handling the block size for smp4vtd i…7.8
• CVE-2025-20889Out-of-bounds read in decoding malformed bitstream for smp4v…5.5
• CVE-2025-20890Out-of-bounds write in decoding frame buffer in libsthmbc.so…7.8
• CVE-2025-20891Out-of-bounds read in decoding malformed bitstream of video …5.5
• CVE-2025-20892Protection Mechanism Failure in bootloader prior to SMR Jan-…5.9
• CVE-2025-20893Improper access control in NotificationManager prior to SMR …5.1
• CVE-2025-20894Improper access control in Samsung Email prior to version 6.…4.6
• CVE-2025-20895Authentication Bypass Using an Alternate Path in Galaxy Stor…4.6