Yapi
Ymfe · 7 CVEs
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi…
Mar 9, 2026
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attack…
Mar 9, 2026
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application di…
Feb 23, 2026
A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows…
Apr 30, 2024
Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/ap…
Jan 26, 2023
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT to…
Mar 1, 2021
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
Sep 28, 2018
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2025-70060 | An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0. | MEDIUM | 0.19% | Mar 9, 2026 |
| CVE-2025-70059 | An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service. | HIGH | 0.34% | Mar 9, 2026 |
| CVE-2025-70058 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by… | HIGH | 0.18% | Feb 23, 2026 |
| CVE-2024-33831 | A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scrip… | HIGH | 0.49% | Apr 30, 2024 |
| CVE-2021-36686 | Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page. | MEDIUM | 0.54% | Jan 26, 2023 |
| CVE-2021-27884 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in… | MEDIUM | 0.34% | Mar 1, 2021 |
| CVE-2018-17574 | An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project. | MEDIUM | 0.67% | Sep 28, 2018 |
Showing 1 to 7 of 7 CVEs