Repository navigation
Security: YAFNET/YAFNET
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Admin Event Log stored XSS via unencoded href built from attacker-controlled X-Real-IPGHSA-phc5-m6cm-5c9f published
Aug 9, 2026 by w8tchaHigh -
Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`GHSA-xhw7-j96h-c3g5 published
Apr 26, 2026 by w8tchaHigh -
Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderGHSA-33gv-fc78-qgf5 published
Apr 26, 2026 by w8tchaHigh -
Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersGHSA-8rq5-wwpp-fmj2 published
Apr 26, 2026 by w8tchaHigh -
YAFNET XSS in EditSignature PageGHSA-mg6p-jjff-7g5m published
Jan 28, 2023 by w8tchaHigh -
Stored XSS in Inbox (Send a private message)GHSA-4hwx-678w-9cp5 published
Jan 22, 2023 by w8tchaHigh -
Stored XSS via usernameGHSA-2vw2-5p2c-pvm3 published
Mar 28, 2021 by w8tchaHigh -
Stored XSS in addressGHSA-8298-m7xr-m859 published
Mar 28, 2021 by w8tchaHigh -
DOM-based XSS via ReturnUrlGHSA-j73j-w29f-hqff published
Mar 28, 2021 by w8tchaHigh -
Pre-auth Stored XSS via FileUploader.ashxGHSA-p7rr-6gx3-2f26 published
Mar 28, 2021 by w8tchaHigh