Ymfe
Products
1- 7 CVEs
Recent CVEs
7| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-70059 | Hig | 0.49 | 7.5 | 0.00 | Mar 9, 2026 | An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service. | ||
| CVE-2025-70058 | Hig | 0.48 | 7.4 | 0.00 | Feb 23, 2026 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests | ||
| CVE-2024-33831 | Hig | 0.48 | 7.4 | 0.00 | Apr 30, 2024 | A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field. | ||
| CVE-2025-70060 | Med | 0.35 | 5.4 | 0.00 | Mar 9, 2026 | An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0. | ||
| CVE-2021-36686 | Med | 0.35 | 5.4 | 0.01 | Jan 26, 2023 | Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page. | ||
| CVE-2018-17574 | Med | 0.35 | 5.4 | 0.01 | Sep 28, 2018 | An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project. | ||
| CVE-2021-27884 | Med | 0.33 | 5.1 | 0.00 | Mar 1, 2021 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used. |
- risk 0.49cvss 7.5epss 0.00
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.
- risk 0.48cvss 7.4epss 0.00
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests
- risk 0.48cvss 7.4epss 0.00
A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.
- risk 0.35cvss 5.4epss 0.00
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
- risk 0.33cvss 5.1epss 0.00
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.