How severe is CVE-2025-14051?

CVE-2025-14051 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2025-14051 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-14051?

CVE-2025-14051 primarily affects Youlai Youlai-mall. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-14051?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-14051 have an EU (EUVD) identifier?

Yes. CVE-2025-14051 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-201314.

When was CVE-2025-14051 published?

CVE-2025-14051 was published on 2025-12-04 and last updated on 2026-06-17.

CVE-2025-14051

CVE-2025-14051 is a medium-severity vulnerability in Youlai Youlai-mall with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-913.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
CVSS v2: 6.5
CVSS v4: 2.1
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-201314
Weakness: CWE-913
Affected product: Youlai Youlai-mall
Published: 2025-12-04
Last modified: 2026-06-17

Description

A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Frequently asked questions

What is CVE-2025-14051?: A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
How severe is CVE-2025-14051?: CVE-2025-14051 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-14051 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-14051?: CVE-2025-14051 primarily affects Youlai Youlai-mall. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-14051?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-14051 have an EU (EUVD) identifier?: Yes. CVE-2025-14051 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-201314.
When was CVE-2025-14051 published?: CVE-2025-14051 was published on 2025-12-04 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:youlai:youlai-mall:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:youlai:youlai-mall:2.0.0:*:*:*:*:*:*:*

More vulnerabilities in Youlai Youlai-mall

CVE-2026-3287 — Medium (CVSS 6.3): A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of…
CVE-2025-14086 — Medium (CVSS 6.3): A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file…
CVE-2025-14085 — Medium (CVSS 6.3): A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file…
CVE-2025-14052 — Medium (CVSS 6.3): A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function…
CVE-2025-15087 — Medium (CVSS 4.3): A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function…
CVE-2025-15086 — Medium (CVSS 4.3): A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of…

All CVEs affecting Youlai Youlai-mall →

Other CWE-913 vulnerabilities

CVE-2026-47208 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout…
CVE-2026-47137 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903)…
CVE-2026-47131 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining…
CVE-2023-29017 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was…
CVE-2022-36067 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version…
CVE-2026-34156 — Critical (CVSS 9.9): NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior…

Browse all CWE-913 vulnerabilities →