Vulnerabilities

TI-2026-74003 CVE-2026-62858 · GHSA-f8ff-652m-j5rx

Unauthenticated file inclusion in YOURLS executes local PHP files

MEDIUM 57

YOURLS is a self-hosted, customizable URL shortener written in PHP.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00468 Published 2026-10-14 Fixed in 1.10.5 CWE-98

TI-2026-45071 CVE-2026-63135 · GHSA-5h77-88j3-r659

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

HIGH 69

YOURLS is a self-hosted, customizable URL shortener written in PHP.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00425 Published 2026-08-21 Fixed in 1.10.4 CWE-79

TI-2022-00039 CVE-2022-0088 · GHSA-gx7g-wjxg-jwwj

Cross-Site Request Forgery (CSRF) in yourls/yourls

LOW 36

Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.01994 Published 2022-04-03 Fixed in 1.8.3 CWE-352

TI-2021-02716 CVE-2021-3785 · GHSA-m9fq-c9hp-59g7

Cross-site Scripting (XSS) - Stored in yourls/yourls

LOW 26

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00721 Published 2021-09-15 Fixed in 1.8.2 CWE-79

TI-2021-02714 CVE-2021-3783 · GHSA-cpq8-x35g-m439

Cross-site Scripting (XSS) - Reflected in yourls/yourls

LOW 28

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00696 Published 2021-09-15 No fix listed CWE-79

TI-2021-02667 CVE-2021-3734 · GHSA-r6g8-jmj9-g945

Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

LOW 38

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00405 Published 2021-08-26 No fix listed CWE-1021

TI-2020-16654 CVE-2020-27388 · GHSA-pwgg-r6fq-mf94

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin…

LOW 26

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00715 Published 2020-10-23 Fixed in 1.8 CWE-79

TI-2019-10834 CVE-2019-14537 · GHSA-vf23-f26f-mjj9

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

MEDIUM 51

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06145 Published 2019-08-07 Fixed in 1.7.4 CWE-843

TI-2014-06965 CVE-2014-8488 · GHSA-j7fj-3fx3-pr27

Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows…

LOW 24

Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01862 Published 2014-12-10 No fix listed CWE-79

TI-2011-03381 CVE-2011-3824 · GHSA-5jp5-g2rv-pmmw

Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive…

LOW 25

Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.p…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01229 Published 2011-09-24 No fix listed CWE-200

Vulnerabilities

Filters