CVE-2025-56161: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, organizations should immediately implement field-level filtering in the User model by defining $hidden or $visible attributes to exclude sensitive fields such as password hashes, mobile numbers, and financial data from API responses. Code reviews and security audits should verify that all API endpoints exposing user-related data enforce strict data minimization principles. Deployers should also consider adding authentication and authorization checks on comment-list API endpoints to restrict access to authorized users only. Rate limiting and anomaly detection mechanisms can help detect and block automated scraping attempts. If possible, patching or upgrading to a fixed version of YOSHOP that addresses this issue should be prioritized once available. In the interim, organizations can implement web application firewalls (WAFs) with custom rules to monitor and block suspicious requests to vulnerable endpoints. Finally, affected organizations should notify users about the potential exposure and recommend password changes and vigilance against phishing attempts.
Description
YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic.