{"id":"CVE-2025-14086","state":"PUBLISHED","title":"youlaitech youlai-mall openid access control","description":"A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of the argument openid results in improper access controls. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-12-05T14:02:08.224Z","updatedAt":"2025-12-05T16:47:56.253Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["youlaitech youlai-mall"],"affected":[{"vendor":"youlaitech","product":"youlai-mall","versions":[{"version":"1.0.0","status":"affected"},{"version":"2.0.0","status":"affected"}]}],"references":["https://vuldb.com/?id.334477","https://vuldb.com/?ctiid.334477","https://vuldb.com/?submit.695945","https://github.com/Hwwg/cve/issues/25"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/14xxx/CVE-2025-14086.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-14086","state":"PUBLISHED","datePublished":"2025-12-05T14:02:08.224Z","dateUpdated":"2025-12-05T16:47:56.253Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-12-05T08:35:06.972Z"},"containers":{"cna":{"title":"youlaitech youlai-mall openid access control","descriptions":[{"lang":"en","value":"A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of the argument openid results in improper access controls. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"youlaitech","product":"youlai-mall","versions":[{"version":"1.0.0","status":"affected"},{"version":"2.0.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.334477","name":"VDB-334477 | youlaitech youlai-mall openid access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.334477","name":"VDB-334477 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.695945","name":"Submit #695945 | youlai-mall latest Improper Control of Resource Identifiers","tags":["third-party-advisory"]},{"url":"https://github.com/Hwwg/cve/issues/25","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-12-05T14:02:08.224Z"},"timeline":[{"time":"2025-12-05T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-12-05T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-12-05T09:40:14.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"huangweigang (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-05T16:05:01.123397Z","id":"CVE-2025-14086","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-05T16:47:56.253Z"}}]}}}