{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/65505?format=json","vulnerability_id":"VCID-sref-fyw7-43dt","summary":"YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and passes it straight to IDbAccess.RunSql with no caller check, yielding arbitrary SQL execution for any low-privileged user. This vulnerability is fixed in 4.0.5.","aliases":[{"alias":"CVE-2026-43937"},{"alias":"GHSA-xhw7-j96h-c3g5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/375930?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.5"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1054216?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta03","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta03"},{"url":"http://public2.vulnerablecode.io/api/packages/1054217?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta04","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta04"},{"url":"http://public2.vulnerablecode.io/api/packages/1054218?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta05","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta05"},{"url":"http://public2.vulnerablecode.io/api/packages/1054219?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta06","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta06"},{"url":"http://public2.vulnerablecode.io/api/packages/1054220?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta07","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta07"},{"url":"http://public2.vulnerablecode.io/api/packages/1054221?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta08","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta08"},{"url":"http://public2.vulnerablecode.io/api/packages/1054222?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-beta09","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-beta09"},{"url":"http://public2.vulnerablecode.io/api/packages/1054223?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-rc01","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-rc01"},{"url":"http://public2.vulnerablecode.io/api/packages/1054224?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-rc02","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-rc02"},{"url":"http://public2.vulnerablecode.io/api/packages/1054225?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-rc03","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-rc03"},{"url":"http://public2.vulnerablecode.io/api/packages/1054226?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0-rc04","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0-rc04"},{"url":"http://public2.vulnerablecode.io/api/packages/1054227?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/1054228?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/1054229?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/1054230?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/1054231?format=json","purl":"pkg:nuget/YAFNET.Core@4.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-32up-xj6g-9qfe"},{"vulnerability":"VCID-58r5-e81x-e7ds"},{"vulnerability":"VCID-sref-fyw7-43dt"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/YAFNET.Core@4.0.4"}],"references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43937","reference_id":"","reference_type":"","scores":[{"value":"0.00029","scoring_system":"epss","scoring_elements":"0.0881","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43937"},{"reference_url":"https://github.com/YAFNET/YAFNET","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/YAFNET/YAFNET"},{"reference_url":"https://github.com/YAFNET/YAFNET/commit/27f7e671f93698f7e014d5d0fb88320248b8aa20","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/YAFNET/YAFNET/commit/27f7e671f93698f7e014d5d0fb88320248b8aa20"},{"reference_url":"https://github.com/YAFNET/YAFNET/releases/tag/v4.0.5","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/YAFNET/YAFNET/releases/tag/v4.0.5"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43937","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43937"},{"reference_url":"https://github.com/advisories/GHSA-xhw7-j96h-c3g5","reference_id":"GHSA-xhw7-j96h-c3g5","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xhw7-j96h-c3g5"},{"reference_url":"https://github.com/YAFNET/YAFNET/security/advisories/GHSA-xhw7-j96h-c3g5","reference_id":"GHSA-xhw7-j96h-c3g5","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track*","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-05-12T15:42:40Z/"}],"url":"https://github.com/YAFNET/YAFNET/security/advisories/GHSA-xhw7-j96h-c3g5"}],"weaknesses":[{"cwe_id":89,"name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component."},{"cwe_id":841,"name":"Improper Enforcement of Behavioral Workflow","description":"The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"7.0 - 8.9","exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sref-fyw7-43dt"}