Skip to content
OpenAdvisories

Package · Packagist

yourls/yourls

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-63135

    YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

    YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.…

    YOURLS YOURLS yourls/yourls Packagist
  • High 7.1
    GHSA-6mp4-q625-mxjp

    YOURLS is vulnerable to XSS through JSONP and Callback request parameters

    ### Summary The callback and **jsonp** request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When **YOURLS_PRIVATE** is set to **false** (public API mode), this vulnerabili…

    yourls/yourls Packagist
  • High 8.8
    CVE-2021-3785

    Cross-site Scripting (XSS) - Stored in yourls/yourls

    yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    YOURLS yourls/yourls yourls/yourls Packagist