CVE-2025-14051

The record

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
• CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
• CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
• CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913
• CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with… CWE-913
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-913
• CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-913
• CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using… CWE-913