YAFNET.Core vulnerabilities (NuGet)

3 vulnerabilities.

• YAFNET.Core NuGet YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers CVE-2026-43939 Fix available 7.3 HighMay 5, 2026
• YAFNET.Core NuGet YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql` CVE-2026-43937 Fix available 8.8 HighMay 5, 2026
• YAFNET.Core NuGet YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header CVE-2026-43938 Fix available 8.1 HighMay 5, 2026