VulnerabilityAnalyzed

CVE-2025-70844

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 6.1EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.27% probability · 19th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: kantorge/yaffa
Source: cve@mitre.org

References

https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844Third Party Advisory
https://github.com/kantorge/yaffaProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.