{"id":"CVE-2025-70844","aliases":["EUVD-2025-209275","GHSA-pq95-94c9-j987"],"status":"published","title":"yaffa vulnerable to Cross Site Scripting","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00282,"percentile":0.20909,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-94"],"published":"2026-04-07T00:00:00Z","modified":"2026-11-04T22:10:00Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"kantorge/yaffa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"kantorge/yaffa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.4.0","0.5.0","0.5.1","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.10.0","1.10.1","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.15.0","1.15.1","1.2.0","1.2.1","1.2.2","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.9.0","2.0.0"]}],"products":[{"vendor":"kantorge","product":"yaffa"}],"references":[{"url":"https://github.com/kantorge/yaffa","tags":["Product","package"]},{"url":"https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70844","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pq95-94c9-j987"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/70xxx/CVE-2025-70844.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-70844","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-04-09T13:59:20.267Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-209275","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-04-09T13:59:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:31.230458Z"}],"ghsa":[{"id":"GHSA-pq95-94c9-j987","title":"yaffa vulnerable to Cross Site Scripting","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T18:31:37Z","modified":"2026-04-10T14:10:58Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:52.102227Z"}],"nvd":[{"id":"CVE-2025-70844","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T17:16:26.297Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-04T23:43:38.567042Z"}],"osv":[{"id":"CVE-2025-70844","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-11-05T21:15:45.394010211Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"GHSA-pq95-94c9-j987","title":"yaffa vulnerable to Cross Site Scripting","description":"yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.","status":"published","published":"2026-04-07T18:31:37Z","modified":"2026-04-10T14:26:22.424553Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}