YMFE/yapi

YMFE/yapi

GitHubGitHub
GitHubgithub.com
yapi.smart-xwork.cnyapi.smart-xwork.cn
Releases81
Frequency3 weeks 2 days
Last Release
Stars27.7K
YApi 是一个可本地部署的、打通前后端及QA的、可视化的接口管理平台
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2025-70060NVD↗
= 1.12.05.4 MEDIUM—

An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.

CVE-2025-70059NVD↗
= 1.12.07.5 HIGH—

An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.

CVE-2025-70058NVD↗
= 1.12.07.4 HIGH—

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests

CVE-2024-33831NVD↗
—7.4 HIGH—

A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.

CVE-2021-33237NVD↗
———

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Consult IDs: CVE-2021-36686. Reason: This candidate is a duplicate of CVE-2021-36686. Notes: All CVE users should reference CVE-2021-36686 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2021-36686NVD↗
= 1.9.15.4 MEDIUM—

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.

CVE-2021-27884NVD↗
<= 1.9.25.1 MEDIUM3.6 LOW

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.

CVE-2018-17574NVD↗
= 1.3.22—3.5 LOW

An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.