CVE-2021-36686

CVE-2021-36686 is an XSS vulnerability in YMFE YApi 1.9.1, exploitable via the /interface/api edit page. The issue affects the web interface code path used to edit API definitions; the precise root cause is described as a Cross Site Scripting flaw. The CVE entry notes that PoC exploits exist (exp...

CVE-2021-27884

The vulnerability CVE-2021-27884 affects YMFE YApi up to version 1.9.2, where JWT signing secret is generated using Math.random() in Node.js. This weak randomness allows an attacker to recreate other users’ JWTs by exploiting predictable secret generation. Connected advisories (GHSA-2H3H-VW8R-82R...

CVE-2018-17574

CVE-2018-17574 affects YMFE YApi 1.3.23 with a stored XSS vulnerability in the project name field. The issue is described across multiple sources (NVD entry and related advisories) as a stored cross-site scripting flaw in YMFE YApi 1.3.23; CVSS v3.0 base score 5.4 (MEDIUM), CVSS v2 base score 3.5...

CVE-2025-70058

The YMFE yapi application, specifically version 1.12.0 , is vulnerable to Improper Certificate Validation (CWE-295). The root cause is the application's HTTPS agent configuration for Axios requests, which sets 'rejectUnauthorized': false, effectively disabling TLS/SSL certificate validation. This...

CVE-2025-70060

The YMFE yapi application, version 1.12.0 , is affected by a vulnerability involving CWE-79: Improper Neutralization of Input During Web Page Generation . This flaw allows for potential cross-site scripting (XSS) attacks. The provided documents do not specify a patched version or a remediation fi...

CVE-2025-70059

The YMFE yapi software, specifically version 1.12.0 , is vulnerable to CWE-400: Uncontrolled Resource Consumption . This flaw allows an attacker to cause a denial of service (DoS) . While the vulnerability is confirmed across multiple sources, there is currently no information regarding a newer v...