TI-2026-31994 Aliases CVE-2026-43937 GHSA-xhw7-j96h-c3g5

YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`

HIGH 73CWE-841Published 2026-05-12 · Updated 2026-05-12

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00489 42nd percentileScored 2026-11-07

Fix Fixed YAFNET (YAFNET): 4.0.5YAFNET.Core (NuGet): 4.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
YAFNET	YAFNET	before 4.0.5	4.0.5	Patch available	CNA
—	YAFNET.Core (NuGet)	before 4.0.5	4.0.5	Patch available	GHSA-xhw7-j96h-c3g5

YAFNET VendorYAFNET Affected before 4.0.5 Fixed in 4.0.5 Patch available CNA
YAFNET.Core (NuGet) Vendor— Affected before 4.0.5 Fixed in 4.0.5 Patch available GHSA-xhw7-j96h-c3g5

Remediation

Fix · CNA YAFNET (YAFNET) Fixed in 4.0.5
Fix · GHSA-xhw7-j96h-c3g5 YAFNET.Core (NuGet) Fixed in 4.0.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-43937
2026-10-03 Alias added: GHSA-xhw7-j96h-c3g5
2026-10-24 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-43937

Other 4

TI-2026-31995 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header CVSS 3.1HIGH 8.1
TI-2026-31996 YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences