PT-2026-37310 · Unknown · Yet Another Forum.Net

Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-43939

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions YetAnotherForum.NET (YAF.NET) versions prior to 4.0.5 YetAnotherForum.NET (YAF.NET) versions prior to 3.2.12

Description The thread posting and reply feature allows user-supplied content to be stored server-side and rendered on the thread page without adequate HTML sanitization or contextual output encoding. This leads to Stored Cross-Site Scripting (XSS), where an attacker can inject arbitrary JavaScript that executes in the browser of any user viewing the affected content. This can result in session or auth-cookie theft, account takeover, forced privileged actions, credential phishing, forum defacement, or malware delivery. The issue is triggered when a post or reply contains a payload, such as "><img src=x onerror=prompt(0)>, which breaks the HTML context and executes the script automatically upon page load.

Recommendations Update to version 4.0.5. Update to version 3.2.12.

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-80

CWE-116

CWE-79

Related Identifiers

CVE-2026-43939

GHSA-8RQ5-WWPP-FMJ2

Affected Products

Yet Another Forum.Net

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43939 · Security Note
• https://osv.dev/vulnerability/GHSA-8rq5-wwpp-fmj2 · Vendor Advisory
• https://github.com/YAFNET/YAFNET/security/advisories/GHSA-8rq5-wwpp-fmj2 · Note
• https://github.com/YAFNET/YAFNET/releases/tag/v4.0.5 · Note
• https://github.com/YAFNET/YAFNET/releases/tag/v3.2.12 · Note
• https://github.com/YAFNET/YAFNET · Note