CVE-2025-70844

{
  "id": "CVE-2025-70844",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:26.297",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the \"Add Account Group\" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page."
    },
    {
      "lang": "es",
      "value": "yaffa v2.0.0 es vulnerable a Cross Site Scripting (XSS). Un atacante puede inyectar JavaScript malicioso en la función ’Add Account Group’ en la página de grupos de cuentas, permitiendo la ejecución de scripts arbitrarios en el contexto de los usuarios que ven la página afectada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T13:58:21.368298Z",
          "id": "CVE-2025-70844",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kantorge:yaffa:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D877A7F1-A45B-4E7C-9686-FF494E9F679D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-70844",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://github.com/kantorge/yaffa",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}