CVE-2025-70060 describes a Cross-Site Scripting (CWE-79) vulnerability in YMFE yapi version 1.12.0, stemming from improper input neutralization during web page generation. Rated Medium severity with a CVSS score of 5.4, this flaw can be exploited remotely with low complexity and no privileges, though user interaction is required. Successful exploitation would lead to low impacts on confidentiality and integrity. There is currently no evidence of active exploitation, and it is not listed in CISA's Known Exploited Vulnerabilities catalog. Furthermore, no public exploit code, community discussion, or media coverage has been identified, indicating a very low probability of exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.12.0CPE matchmatch criteria | cpe:2.3:a:ymfe:yapi:1.12.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.