Skip to content
Threat Feed

Product

YAFNET.Core (<= 4.0.4)

1 brief RSS
critical advisory

YAFNET Pre-Handler Authorization Bypass Leads to SQL Injection

YAFNET's flawed authorization allows low-privileged users to execute arbitrary SQL commands via the `/Admin/RunSql` endpoint, potentially leading to data exfiltration, application modification, and denial-of-service.

YAFNET.Core sql-injection web-application vulnerability
2r 8t