Vendors / Ymfe Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Ymfe records in CISA KEV No Ymfe vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 58
Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00564 · Published 2023-01-26 · No fix listed CWE-79
Priority LOW 39
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-03-09 · No fix listed CWE-400
Priority LOW 34
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.
CVSS 3.1 HIGH 7.4· Network · No auth · No interaction · EPSS 0.0019 · Published 2026-02-23 · No fix listed CWE-295
Priority LOW 26
An issue was discovered in YMFE YApi 1.3.23.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00667 · Published 2018-09-28 · Fixed in 1.3.23 CWE-79
Priority LOW 24
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
CVSS 3.1 MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-03-09 · No fix listed CWE-79
Priority LOW 23
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.
CVSS 3.1 MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.00338 · Published 2021-03-01 · Fixed in 1.9.3 CWE-330
Open these records in search → All records by CVSS severity
0 2 4 0 0
THREATIST.IORead the docs