Read the docs

shlinkio

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

shlinkio records in CISA KEV

No shlinkio vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-62505 CVE-2026-92760 · GHSA-r72g-8wq6-6m7w

Shlink through 5.1.6 Mercure Token Authorization Bypass

Priority MEDIUM 64

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-16 No fix listed CWE-863
TI-2026-15355 CVE-2026-18737 · GHSA-2jhc-j623-f52p

Shlink Blind SQL Injection via tags/stats orderBy Parameter

Priority MEDIUM 64

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag sta…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00399 Published 2026-08-03 No fix listed CWE-89
TI-2026-15354 CVE-2026-18736 · GHSA-c6g4-pfhg-gvmp

Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Priority MEDIUM 57

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation wit…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-08-03 No fix listed CWE-918
TI-2026-15356 CVE-2026-18738 · GHSA-ghrv-q878-w45x

Shlink CSV Formula Injection via Visit Export CLI

Priority LOW 30

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00493 Published 2026-08-03 No fix listed CWE-1236
Open these records in search →