Vulnerabilities

TI-2025-43011 CVE-2025-70060 · GHSA-qrm8-hg22-g769

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page…

LOW 24

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00223 Published 2026-03-09 No fix listed CWE-79

TI-2025-43010 CVE-2025-70059 · GHSA-v99m-mg69-c6w4

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE…

LOW 39

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-03-09 No fix listed CWE-400

TI-2025-43009 CVE-2025-70058 · GHSA-663h-2vr3-ghrj

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE…

LOW 34

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0019 Published 2026-02-23 No fix listed CWE-295

TI-2021-14834 CVE-2021-36686 · GHSA-4jqw-vfmj-9rmh

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00564 Published 2023-01-26 No fix listed CWE-79

TI-2021-09224 CVE-2021-27884 · GHSA-2h3h-vw8r-82rp

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows…

LOW 23

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00338 Published 2021-03-01 Fixed in 1.9.3 CWE-330

TI-2018-12520 CVE-2018-17574 · GHSA-5xgh-643p-cp2g

An issue was discovered in YMFE YApi 1.3.23.

LOW 26

An issue was discovered in YMFE YApi 1.3.23.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2018-09-28 Fixed in 1.3.23 CWE-79

Vulnerabilities

Filters

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page…

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE…

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE…

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute…

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows…

An issue was discovered in YMFE YApi 1.3.23.