Youlai
Monthly
SQL injection in Youlai Mall 2.0.0's product pagination endpoint allows authenticated remote attackers to manipulate the sortField parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and the vendor has not provided a patch. Attackers with valid credentials can exploit this flaw to read or modify sensitive data within the database.
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (`src/views/system/notice/index.vue`). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
In youlai-mall 1.0.0 and 2.0.0, authenticated users with low privileges can manipulate the orderId parameter in the /app-api/v1/orders/ endpoint due to improper control of dynamically-identified variables, leading to unauthorized access or modification of other users' order data. The vulnerability is remotely exploitable and a public proof-of-concept is available, though no vendor patch has been confirmed. EPSS indicates very low exploitation probability (0.06%), and the vulnerability is not listed in CISA KEV.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
Improper control of dynamically-identified variables in youlai-mall 1.0.0/2.0.0 allows authenticated low-privilege users to read or modify other users’ address data via the /mall-ums/app-api/v1/addresses/ endpoint. Public exploit code is available, though no evidence of active exploitation exists at this time. The vendor was notified but did not respond.
Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Youlai Mall 2.0.0's product pagination endpoint allows authenticated remote attackers to manipulate the sortField parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and the vendor has not provided a patch. Attackers with valid credentials can exploit this flaw to read or modify sensitive data within the database.
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (`src/views/system/notice/index.vue`). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
In youlai-mall 1.0.0 and 2.0.0, authenticated users with low privileges can manipulate the orderId parameter in the /app-api/v1/orders/ endpoint due to improper control of dynamically-identified variables, leading to unauthorized access or modification of other users' order data. The vulnerability is remotely exploitable and a public proof-of-concept is available, though no vendor patch has been confirmed. EPSS indicates very low exploitation probability (0.06%), and the vulnerability is not listed in CISA KEV.
A security vulnerability in A vulnerability (CVSS 6.3). Risk factors: public PoC available.
Improper control of dynamically-identified variables in youlai-mall 1.0.0/2.0.0 allows authenticated low-privilege users to read or modify other users’ address data via the /mall-ums/app-api/v1/addresses/ endpoint. Public exploit code is available, though no evidence of active exploitation exists at this time. The vendor was notified but did not respond.
Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.