CVE-2025-70844

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

Vulnerability Details

Published Date

April 07, 2026

Last Modified

April 14, 2026

CWE ID

CWE-94

Source

NVD

Vendor

kantorge

Product

yaffa

External References

https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844
https://github.com/kantorge/yaffa

CVE-2025-70844

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment