Yourls
Monthly
Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.
Path traversal in YOURLS before 1.10.5 lets an attacker escalate a pre-planted PHP file into code execution: the keyword returned by yourls_get_request() survives yourls_sanitize_url() and yourls_esc_url(), is passed to file_exists() and include() under YOURLS_PAGEDIR, and '../' or '..\' sequences let it resolve a script outside the pages directory, which then runs with the privileges of the YOURLS web process. Exploitation is conditional and chained rather than self-contained - the vulnerable code supplies only the include primitive, so an attacker must first get a PHP file onto the server through a separate upload or file-write vector, which the advisory acknowledges by describing an 'uploaded or injected file'. No public exploit code has been identified at time of analysis, and the supplied CVSS 5.3 (AV:L/AC:L/PR:L) conflicts with the independent assessment, which rates this inclusion primitive CVSS 8.1 (AV:N/AC:H/PR:N) while still classifying overall risk as medium severity given the hard file-precondition.
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.
Path traversal in YOURLS before 1.10.5 lets an attacker escalate a pre-planted PHP file into code execution: the keyword returned by yourls_get_request() survives yourls_sanitize_url() and yourls_esc_url(), is passed to file_exists() and include() under YOURLS_PAGEDIR, and '../' or '..\' sequences let it resolve a script outside the pages directory, which then runs with the privileges of the YOURLS web process. Exploitation is conditional and chained rather than self-contained - the vulnerable code supplies only the include primitive, so an attacker must first get a PHP file onto the server through a separate upload or file-write vector, which the advisory acknowledges by describing an 'uploaded or injected file'. No public exploit code has been identified at time of analysis, and the supplied CVSS 5.3 (AV:L/AC:L/PR:L) conflicts with the independent assessment, which rates this inclusion primitive CVSS 8.1 (AV:N/AC:H/PR:N) while still classifying overall risk as medium severity given the hard file-precondition.
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.