CVE-2026-43939

High

Published: 12/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

YetAnotherForum.NET (YAF.NET) prior to versions 4.0.5 and 3.2.12 has a vulnerability that allows for the injection of unsafe HTML code by users in posts and replies. This content is stored server-side and rendered back into the thread page without adequate HTML sanitization.

Risk Assessment

The lack of proper sanitization may lead to XSS attacks, jeopardizing user data security and forum integrity. Organizations may face loss of user trust and potential legal consequences.

Recommendation

It is recommended to upgrade to versions 4.0.5 or 3.2.12 to eliminate this vulnerability. Additionally, implementing further input sanitization mechanisms is advisable.

Other vulnerabilities in YetAnotherForum.NET (YAF.NET)

CVE-2026-43937High
In YetAnotherForum.NET (YAF.NET) prior to version 4.0.5, there is a vulnerability that allows arbitrary SQL execution by low-privileged users. The issue is related to the OnPost… handler in the admin panel, where there are insufficient checks for SQL queries.

Original NVD description (English source)

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.