CVE-2025-14016CWE-266CWE-285CWE-863broken-access-control

CVE-2025-14016

Medium · published December 5, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such manipulation of the argument ids leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2025-12-05T00:16Z
Affected products (1)
ProductVersionsFixed in
macrozheng/mall-swarm≤ 1.0.3—
References (5)
https://github.com/Hwwg/cve/issues/17 · [email protected]https://vuldb.com/?ctiid.334257 · [email protected]https://vuldb.com/?id.334257 · [email protected]https://vuldb.com/?submit.694797 · [email protected]https://github.com/Hwwg/cve/issues/17 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 04 DEC 18:32Z
    macrozheng mall-swarm delete improper authorization
    cvelistv5