NuGetPackage

YAFNET.Core

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-43937High 8.8
YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`
Affected: fixed in 4.0.5.
Fixed in 4.0.5 (released Apr 26, 2026, 16 days before disclosure).
The latest release, 4.0.10, is not affected.
CVE-2026-43938High 8.1
YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
Affected: from 4.0.0-beta01, fixed in 4.0.5; fixed in 3.2.12.
Fixed in 4.0.5 (released Apr 26, 2026, 16 days before disclosure, the advisory names 3.2.12, which was never published).
The latest release, 4.0.10, is not affected.
CVE-2026-43939High 7.3
YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers
Affected: from 4.0.0-beta01, fixed in 4.0.5; fixed in 3.2.12.
Fixed in 4.0.5 (released Apr 26, 2026, 16 days before disclosure, the advisory names 3.2.12, which was never published).
The latest release, 4.0.10, is not affected.