CVE-2025-70844

6.1 mediumEPSS 0.3%

Medium (6.1) in kantorge yaffa. EPSS 0.3% chance of exploitation in the next 30 days.

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-04-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kantorge:yaffa

References

https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844
https://github.com/kantorge/yaffa

Check your stack JSON