Skip to content
OpenAdvisories

Package · Packagist

yourls/yourls

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 5.3
    CVE-2026-62858

    YOURLS: Unauthenticated File Inclusion

    YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences befor…

    YOURLS YOURLS yourls/yourls Packagist
  • High 8.2
    CVE-2026-63135

    YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

    YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.…

    YOURLS YOURLS yourls/yourls Packagist
  • High 7.1
    GHSA-6mp4-q625-mxjp

    YOURLS is vulnerable to XSS through JSONP and Callback request parameters

    ### Summary The callback and **jsonp** request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When **YOURLS_PRIVATE** is set to **false** (public API mode), this vulnerabili…

    yourls/yourls Packagist
  • Low 3.5
    CVE-2022-0088 Public exploit

    Cross-Site Request Forgery (CSRF) in yourls/yourls

    Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

    YOURLS yourls/yourls yourls/yourls Packagist
  • High 8.8
    CVE-2021-3785

    Cross-site Scripting (XSS) - Stored in yourls/yourls

    yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    YOURLS yourls/yourls yourls/yourls Packagist
  • Medium 6.6
    CVE-2021-3783

    Cross-site Scripting (XSS) - Reflected in yourls/yourls

    yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    YOURLS yourls/yourls yourls/yourls Packagist
  • Medium 6.5
    CVE-2021-3734

    Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

    yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames

    YOURLS yourls/yourls yourls/yourls Packagist
  • Medium 5.4
    CVE-2020-27388

    YOURLS Stored Cross Site Scripting (XSS)

    Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

    yourls/yourls Packagist
  • Critical 9.8
    CVE-2019-14537 Public exploit

    Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls

    YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

    yourls/yourls Packagist