Ymfe vulnerabilities
Published CVEs affecting Ymfe products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-70060
Medium · 5.4
CWE-79 Mar 9, 2026
Cross-site Scripting (XSS) in Ymfe Yapi
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
CVE-2025-70059
High · 7.5
CWE-400 Mar 9, 2026
Uncontrolled Resource Consumption in Ymfe Yapi
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.
CVE-2025-70058
High · 7.4
CWE-295 Feb 23, 2026
Improper Certificate Validation in Ymfe Yapi
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests