VULNERABILITY INTELLIGENCE

CVE-2025-70844

CVSS score6.1 MEDIUM

EPSS probability0.27%

CISA KEVNot currently listed

Published2026-04-07

Last modified2026-06-17

Description

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.