CVE-2026-43937

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In YetAnotherForum.NET (YAF.NET) prior to version 4.0.5, there is a vulnerability that allows arbitrary SQL execution by low-privileged users. The issue is related to the OnPost… handler in the admin panel, where there are insufficient checks for SQL queries.

Risk Assessment

The organization may be exposed to unauthorized SQL query execution, potentially leading to data loss or system compromise. Low-privileged users could gain access to sensitive administrative operations.

Recommendation

It is recommended to upgrade to version 4.0.5 or later to mitigate this vulnerability. Additionally, conducting a security audit of the application to identify other potential weaknesses is advisable.

Other vulnerabilities in YetAnotherForum.NET (YAF.NET)

CVE-2026-43939High
YetAnotherForum.NET (YAF.NET) prior to versions 4.0.5 and 3.2.12 has a vulnerability that allows for the injection of unsafe HTML code by users in posts and replies. This content is stored server-side and rendered back into the thread page without adequate HTML sanitization.

Original NVD description (English source)

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.