Ymfe Yapi
6 CVEs affecting Ymfe Yapi. Latest disclosed: 2026-03-09. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-70059 | High | 7.5 | 2026-03-09 | An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service. |
CVE-2025-70058 | High | 7.4 | 2026-02-23 | An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by… |
CVE-2025-70060 | Medium | 5.4 | 2026-03-09 | An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0. |
CVE-2021-36686 | Medium | 5.4 | 2023-01-26 | Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page. |
CVE-2018-17574 | Medium | 5.4 | 2018-09-28 | An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project. |
CVE-2021-27884 | Medium | 5.1 | 2021-03-01 | Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in… |