CVE-2026-43938
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedYetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNET.Core/Logger/DbLogger.cs) captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column whenever an event (e.g., an unhandled exception) is logged. The admin event-log page (YetAnotherForum.NET/Pages/Admin/EventLog.cshtml.cs) later deserializes that JSON in FormatStackTrace() and interpolates the UserAgent value directly into an HTML string with no encoding, and the Razor view EventLog.cshtml emits the result through @Html.Raw. This vulnerability is fixed in 4.0.5 and 3.2.12.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceYAF.NET's database logger stores the User-Agent header as JSON in the EventLog.Description column when exceptions occur. The admin event-log page deserializes this JSON and interpolates the UserAgent value directly into HTML without encoding, then renders it via @Html.Raw, creating a stored XSS vulnerability. An attacker can inject malicious JavaScript via the User-Agent header that executes when admins view the event log.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify YAF.NET versionLocate the YAF.NET assembly (typically in /bin folder) or check the version number in the application's assembly metadata, web.config, or a versions.txt file if included.Affected if The installed version is prior to 4.0.5 (for the 4.x branch) or prior to 3.2.12 (for the 3.x branch).
-
Confirm database logger is enabledInspect the YAF.NET configuration file (usually app.config or web.config in the application root) for a logger configuration entry. Look for a database logger or EventLog logger provider configured under the logging or YAF settings section.Affected if Database or EventLog logger is explicitly configured and active, causing User-Agent data to be written to the EventLog.Description column in the database.
-
Verify admin event log view is accessibleCheck if the YAF.NET admin role or user accounts exist and have access to the admin panel. Confirm the event log viewing module is enabled in the admin control panel permissions.Affected if Admin accounts can access the event log viewer page, which is required for the XSS to trigger.
-
Inspect the event log view rendering codeLocate the admin event log display page in the YAF.NET source (typically named something like EventLog or AdminLog with an .aspx or .cshtml extension). Examine the code that renders the UserAgent field from the EventLog.Description JSON, looking specifically for @Html.Raw usage without prior HTML encoding.Affected if The code uses @Html.Raw to render the deserialized UserAgent value without applying Html.Encode or equivalent encoding first.
A user is affected if they run a vulnerable YAF.NET version (pre-4.0.5 or pre-3.2.12), have the database logger enabled, and allow admin access to the event log viewing page with unencoded @Html.Raw rendering of UserAgent data.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to YAF.NET version 4.0.5 or 3.2.12, or apply the vendor patch which adds proper HTML encoding when rendering the UserAgent value in the admin event log view.
Upgrade to YAF.NET 4.0.5 (for 4.x branch) or 3.2.12 (for 3.x branch)
- 1. Identify the currently deployed YAF.NET version by checking the assembly version or NuGet package reference.
- 2. If running a version prior to 4.0.5 on the 4.x branch, upgrade to version 4.0.5 or later.
- 3. If running a version prior to 3.2.12 on the 3.x branch, upgrade to version 3.2.12 or later.
- 4. Verify the upgrade by checking the YAFNET.Core/Logger/DbLogger.cs file to confirm the User-Agent is now properly encoded before storage, and that EventLog.cshtml.cs uses proper HTML encoding when rendering.
- 5. Test the admin event-log page to confirm the XSS vulnerability is no longer present.
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation1.0 h
- Implementation2.0 h
- Testing2.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,664.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-43938 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-43938 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data