The flaw arises because YAF.NET logs the User‑Agent header into the event log without validation or encoding. During an error, the logged data is later deserialized and injected into an HTML string that is rendered with raw HTML, allowing attacker‑controlled characters to become executable script. This second‑order stored XSS can compromise any administrator who views the event‑log page, potentially leading to session hijack, credential theft, or further attacks against the forum system.

YetAnotherForum.NET (YAF.NET) is vulnerable in all releases older than version 4.0.5 and 3.2.12. The affected component is the database logger that captures the User‑Agent header for all requests, and the admin event‑log page that displays the stored entries.

The vulnerability has a CVSS score of 8.1, indicating high criticality. No EPSS score is available, so the likelihood of exploitation is unclear but the lack of mitigation plus the fact that it is unauthenticated means an attacker can easily craft a malicious User‑Agent header via a regular HTTP request. The flaw is not listed in CISA’s KEV catalog, but its potential for widespread damage makes it a serious risk when the affected versions are in use.