Cross Site Scripting (XSS)

2024-05-0208:09:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site scripting

input validation

arbitrary execution

web scripts

html

crafted payload

vulnerable software

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

yapi-vendor is vulnerable to Cross Site Scripting (XSS). The vulnerability is due to insufficient input validation in its Advanced Expectation - Response module, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.

CPENameOperatorVersion
yapi-vendorle1.12.0
yapi-vendorle1.12.0

CPE	Name	Operator	Version
	yapi-vendor	le	1.12.0
	yapi-vendor	le	1.12.0

References

github.com/advisories/GHSA-5626-x6h5-mpm4

github.com/YMFE/yapi/issues/2745