TI-2026-45071 CVE-2026-63135 · GHSA-5h77-88j3-r659
YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
Priority HIGH 69
YOURLS is a self-hosted, customizable URL shortener written in PHP.
yourls
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
yourls records in CISA KEVNo yourls vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2026-74003 CVE-2026-62858 · GHSA-f8ff-652m-j5rx
Unauthenticated file inclusion in YOURLS executes local PHP files
Priority MEDIUM 57
YOURLS is a self-hosted, customizable URL shortener written in PHP.
TI-2019-10834 CVE-2019-14537 · GHSA-vf23-f26f-mjj9
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
Priority MEDIUM 51
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
TI-2021-02667 CVE-2021-3734 · GHSA-r6g8-jmj9-g945
Improper Restriction of Rendered UI Layers or Frames in yourls/yourls
Priority LOW 38
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
TI-2022-00039 CVE-2022-0088 · GHSA-gx7g-wjxg-jwwj
Cross-Site Request Forgery (CSRF) in yourls/yourls
Priority LOW 36
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
TI-2021-02714 CVE-2021-3783 · GHSA-cpq8-x35g-m439
Cross-site Scripting (XSS) - Reflected in yourls/yourls
Priority LOW 28
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TI-2021-02716 CVE-2021-3785 · GHSA-m9fq-c9hp-59g7
Cross-site Scripting (XSS) - Stored in yourls/yourls
Priority LOW 26
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TI-2020-16654 CVE-2020-27388 · GHSA-pwgg-r6fq-mf94
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin…
Priority LOW 26
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.
TI-2011-03381 CVE-2011-3824 · GHSA-5jp5-g2rv-pmmw
Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive…
Priority LOW 25
Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.p…
TI-2014-06965 CVE-2014-8488 · GHSA-j7fj-3fx3-pr27
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.