Vendors / yourls Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 3
Exploited now yourls records in CISA KEV No yourls vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 51
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06145 · Published 2019-08-07 · Fixed in 1.7.4 CWE-843
Priority LOW 38
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00405 · Published 2021-08-26 · No fix listed CWE-1021
Priority LOW 36
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
CVSS 3.1 HIGH 7.4· Network · No auth · User interaction · EPSS 0.01994 · Published 2022-04-03 · Fixed in 1.8.3 CWE-352
Priority LOW 28
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00696 · Published 2021-09-15 · No fix listed CWE-79
Priority LOW 26
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00721 · Published 2021-09-15 · Fixed in 1.8.2 CWE-79
Priority LOW 26
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00715 · Published 2020-10-23 · Fixed in 1.8 CWE-79
Priority LOW 25
Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.p…
CVSS 2.0 MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01229 · Published 2011-09-24 · No fix listed CWE-200
Priority LOW 24
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01862 · Published 2014-12-10 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
1 3 6 0 0
THREATIST.IORead the docs