Ymfe Yapi — known CVE vulnerabilities

Every CVE whose affected-product data names Ymfe Yapi, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2025-70059 — CVSS 7.5 (high): An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a…
• CVE-2025-70058 — CVSS 7.4 (high): An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL…
• CVE-2018-17574 — CVSS 5.4 (medium): An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
• CVE-2021-36686 — CVSS 5.4 (medium): Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
• CVE-2025-70060 — CVSS 5.4 (medium): An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
• CVE-2021-27884 — CVSS 5.1 (medium): Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs…