CVE-2025-70844

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the acc...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

advisory github.com
advisory nvd.nist.gov
package github.com
web github.com