CVE-2026-43939

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.

Score

CVSS 3.1 7.3 High

Status

Deferred - security-advisories@github.com

Published

2026-05-12

Last modified

2026-05-13

Weaknesses

CWE-116, CWE-79, CWE-80

Affected products

• Yafnet (Yafnet)

References

• https://github.com/YAFNET/YAFNET/security/advisories/GHSA-8rq5-wwpp-fmj2