Quick answers
- Is CVE-2025-70060 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-70060 being exploited in the wild.
- How severe is CVE-2025-70060?
- Medium severity, with a CVSS score of 5.4, published 9 March 2026.
- Which products and versions are affected?
- YMFE yapi 1.12.0.
- Is there a fix for CVE-2025-70060?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-70060 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-70060?
- Check whether you run Ymfe Yapi. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Scripting (XSS) vulnerability (CWE-79) exists in YMFE YApi version 1.12.0. The issue stems from improper neutralization of user-supplied input during the generation of web pages, allowing an attacker to inject malicious scripts. The attack vector is network-based and requires user interaction (UI:R), typically involving a victim visiting a specially crafted link or viewing malicious content within the YApi interface. Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the victim's session, potentially resulting in session hijacking or unauthorized data exfiltration. At the time of reporting, the vulnerability is identified in version 1.12.0.
Affected products
- YMFE yapi 1.12.0
Timeline
- 2026-03-09: disclosed: Initial disclosure and CVE assignment
- 2026-03-09: advisory: NVD publication date