CVE-2026-110613Medium· 6.5▾ Sunlityoulai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-15087Medium· 4.3A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0
CVE-2025-15086Medium· 4.3A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0
CVE-2025-15084Low· 3.1A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0
CVE-2025-15085Medium· 4.3A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0
CVE-2025-14052Medium· 6.3A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0
CVE-2026-110216High· 7.1youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check