We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-43939

CVE-2026-43939

ASP.NET

Severity: HIGH
CVSS: 7.3CVSS
Published: 2026-05-12
Last modified: 2026-05-12
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE: CWE-79CWE-80CWE-116

Description

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature accepts user-supplied content via a a post or reply that is stored server-side and later rendered back into the thread page without adequate HTML sanitization or contextual output encoding. This vulnerability is fixed in 4.0.5 and 3.2.12.

References

https://github.com/YAFNET/YAFNET/security/advisories/GHSA-8rq5-wwpp-fmj2

Summary

Description

References