CVE-2025-70844: Kantorge Yaffa

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view the affected page.

Affected products

• Kantorge Yaffa: version 2.0.0 only

Published 2026-04-07. Last modified 2026-06-17.