YAFNET YAFNET

• CVE-2026-43937 High 8.8 YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql` 0.5%
• CVE-2026-43938 High 8.1 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header 0.3%
• CVE-2026-43939 High 7.3 YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers 0.2%