Youlai
10 CVEs across 3 Youlai products. Browse Youlai vulnerabilities, severities, and proof-of-concept exploits.
Youlai products with known CVEs
Youlai CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-3287 | Medium | 6.3 | 2026-02-27 | A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/c… |
CVE-2025-15372 | Low | 2.4 | 2025-12-31 | A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/ind… |
CVE-2025-15087 | Medium | 4.3 | 2025-12-25 | A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src… |
CVE-2025-15086 | Medium | 4.3 | 2025-12-25 | A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/c… |
CVE-2025-15085 | Medium | 4.3 | 2025-12-25 | A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/… |
CVE-2025-15084 | Low | 3.1 | 2025-12-25 | A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/… |
CVE-2025-66736 | High | 7.1 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the cu… |
CVE-2025-66735 | High | 7.5 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may… |
CVE-2025-14086 | Medium | 6.3 | 2025-12-05 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
CVE-2025-14085 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the… |
CVE-2025-14052 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function getMemberById of the file /mall-ums/app-ap… |
CVE-2025-14051 | Medium | 6.3 | 2025-12-04 | A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addr… |
CVE-2025-55471 | High | 7.5 | 2025-11-26 | Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. |
CVE-2025-55469 | Critical | 9.8 | 2025-11-26 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. |