Is there a public PoC exploit available for CVE-2025-15084?

Yes, a public proof-of-concept exploit is available for CVE-2025-15084. Prioritise patching immediately. EPSS: 0.1%.

Youlai Mall CVE-2025-15084

Q: What is the CVSS score of CVE-2025-15084?

CVE-2025-15084 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Incorrect Privilege Assignment (CWE-266)

2025-12-25 cna@vuldb.com

Java Information Disclosure Youlai Mall Youlai

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 03:00 vuln.today

DescriptionCVE.org

A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.

Technical ContextAI

The vulnerability exists in the order payment processing function within the Youlai Mall e-commerce application's order management service (OMS). Specifically, the OrderController.orderService.payOrder method in mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java implements insufficient access control checks before processing payment-related operations. The CWE-266 classification (Incorrect Privilege Assignment) indicates the root cause is improper validation of user permissions when executing sensitive payment operations. The attack vector is network-based (AV:N), meaning exploitation occurs over the network, but requires authenticated user context (PR:L) and high attack complexity (AC:H), suggesting the attack requires specific conditions or knowledge of the application's internal state to succeed.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted during responsible disclosure but provided no response. Organizations running Youlai Mall 1.0.0 or 2.0.0 should immediately review and audit the OrderController.orderService.payOrder method to implement explicit role-based access control (RBAC) checks before permitting access to payment data. Specifically, verify that users can only view payment information for orders they own or are explicitly authorized to manage, and that administrative payment operations require elevated privileges. If source code patches cannot be applied due to vendor non-response, implement compensating controls: configure network access controls to restrict the Order Payment API endpoint to trusted IP ranges or specific internal networks only; enforce mutual TLS (mTLS) authentication for payment operations; implement application-level audit logging to detect unauthorized access attempts to payment functions; and consider disabling or rate-limiting the affected payment endpoint until code-level fixes can be applied. Check the GitHub repository referenced in the POC (https://github.com/Hwwg/cve/issues/24) for community-contributed patches or workarounds. Evaluate upgrading to a newer version of Youlai Mall if available, though no specific patched version is confirmed in available data.