CVE-2025-15085HIGH 8.1EPSS p17.0%

CVE-2025-15085CVE-2025-15085

Description

A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS0.26% probability of exploitation · percentile 17.0% · 2026-06-19T12:03:05Z
Published2025-12-25
Last modified2026-04-29

Underlying weaknesses· 3

CWE-266CWE-285CWE-863

References

  1. https://github.com/Hwwg/cve/issues/26
  2. https://vuldb.com/?ctiid.338413
  3. https://vuldb.com/?id.338413
  4. https://vuldb.com/?submit.708175

3

TypeTargetConfidenceTier
WeaknessIncorrect Privilege Assignmentcwe-2660%live
WeaknessImproper Authorizationcwe-2850%live
WeaknessIncorrect Authorizationcwe-8630%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-14086
CVE
CVE-2025-14085
CVE
CVE-2025-14051
CVE
CVE-2026-3287
CVE
CVE-2025-4118
CVE
CVE-2025-14016
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.