YAFNET vulnerabilities
We track 3 vulnerabilities in YAFNET products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 12, 2026.
Latest YAFNET vulnerabilities
- 7.3 High severity
YAFNET: Improper Neutralization of Input During Web Page Generation
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HT
- 8.1 High severity
YAFNET: Improper Neutralization of Input During Web Page Generation
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the
- 8.8 High severity
YAFNET: Improper Neutralization of Special Elements used in an SQL Command
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery