CVE-2025-4118

CVE-2025-4118 is a critical improper access controls vulnerability affecting Weitong Mall 1.0.0, specifically within the Product History Handler component. This flaw allows remote attackers to manipulate the ‘isDelete’ argument in the /historyList file, leading to unauthorized access. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in high confidentiality and integrity impacts. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the exploit has been publicly disclosed, and there is some community discussion surrounding it.