CVE-2025-4119

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Weitong Mall 1.0.0. This vulnerability affects unknown code of the file /queryTotal of the component Product Statistics Handler. The manipulation of the argument isDelete with the input 1 leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-266 CWE-284 CWE-639

Affected software

Vendor	Product	Versions
Weitong	Mall	1.0.0

References

https://vuldb.com/?ctiid.306604Permissions Required, VDB Entry
https://vuldb.com/?id.306604Third Party Advisory, VDB Entry
https://vuldb.com/?submit.560778Third Party Advisory, VDB Entry
https://www.cnblogs.com/aibot/p/18830908Third Party Advisory

Timeline

Published: Apr 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-41209.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manip CVE-2025-41219.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function c CVE-2025-41228.8A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. CVE-2025-412225.3A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCO CVE-2025-412234.8A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (All versions), RUGGEDCO CVE-2025-412248.8A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), R CVE-2025-412258.8The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms a CVE-2025-412266.8VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation CVE-2025-412275.5VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-admi CVE-2025-412284.3VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor wi CVE-2025-412298.2VMware Cloud Foundation contains a directory traversal vulnerability. A malicious actor with network access to port 443 on VMware Cloud Foun CVE-2025-41236.1A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows atta