Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-62858 (GCVE-0-2026-62858)

Vulnerability from nvd – Published: 2026-10-14 15:42 – Updated: 2026-10-14 17:47

Title

YOURLS: Unauthenticated File Inclusion

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 17:46 UTC

CWE

CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7609 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/YOURLS/YOURLS/security/advisor…	x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4142	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/4e8597216…	x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
YOURLS	YOURLS	Affected: < 1.10.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62858",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:46:13.681061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:47:22.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:42:51.362Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/pull/4142",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/4142"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.5"
        }
      ],
      "source": {
        "advisory": "GHSA-f8ff-652m-j5rx",
        "discovery": "UNKNOWN"
      },
      "title": "YOURLS: Unauthenticated File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62858",
    "datePublished": "2026-10-14T15:42:51.362Z",
    "dateReserved": "2026-07-14T21:10:50.032Z",
    "dateUpdated": "2026-10-14T17:47:22.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63135 (GCVE-0-2026-63135)

Vulnerability from nvd – Published: 2026-08-21 20:40 – Updated: 2026-08-26 17:40

Title

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 17:40 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7609 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/YOURLS/YOURLS/security/advisor…	x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4107	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/e1e934766…	x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
YOURLS	YOURLS	Affected: >= 1.5.1, < 1.10.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:40:19.146156Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:40:42.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.1, \u003c 1.10.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:40:08.199Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/pull/4107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/4107"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
        }
      ],
      "source": {
        "advisory": "GHSA-5h77-88j3-r659",
        "discovery": "UNKNOWN"
      },
      "title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63135",
    "datePublished": "2026-08-21T20:40:08.199Z",
    "dateReserved": "2026-07-15T16:54:55.817Z",
    "dateUpdated": "2026-08-26T17:40:42.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-0088 (GCVE-0-2022-0088)

Vulnerability from nvd – Published: 2022-04-03 08:50 – Updated: 2026-02-16 14:48

Title

Cross-Site Request Forgery (CSRF) in yourls/yourls

Summary

Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://huntr.dev/bounties/d01f0726-1a0f-4575-ae1…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/1de256d86…	x_refsource_MISC
https://github.com/MarkLee131/awesome-web-pocs/bl…

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , < 1.8.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-16T14:48:06.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2022-0088.md"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThan": "1.8.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-03T08:50:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
        }
      ],
      "source": {
        "advisory": "d01f0726-1a0f-4575-ae17-4b5319b11c29",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0088",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.8.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
            }
          ]
        },
        "source": {
          "advisory": "d01f0726-1a0f-4575-ae17-4b5319b11c29",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0088",
    "datePublished": "2022-04-03T08:50:10.000Z",
    "dateReserved": "2022-01-04T00:00:00.000Z",
    "dateUpdated": "2026-02-16T14:48:06.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-3785 (GCVE-0-2021-3785)

Vulnerability from nvd – Published: 2021-09-15 12:05 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in yourls/yourls

Summary

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/b4085d13-54fa-4419-a2c…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/1d8e224eb…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , < 1.8.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThan": "1.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-15T12:05:13.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
        }
      ],
      "source": {
        "advisory": "b4085d13-54fa-4419-a2ce-1d780cc31638",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3785",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
            }
          ]
        },
        "source": {
          "advisory": "b4085d13-54fa-4419-a2ce-1d780cc31638",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3785",
    "datePublished": "2021-09-15T12:05:13.000Z",
    "dateReserved": "2021-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3783 (GCVE-0-2021-3783)

Vulnerability from nvd – Published: 2021-09-15 12:00 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Reflected in yourls/yourls

Summary

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

6.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/94f6bab91…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , ≤ 1.8.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:08.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThanOrEqual": "1.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-15T12:00:18.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
        }
      ],
      "source": {
        "advisory": "b688e553-d0d9-4ddf-95a3-ff4b78004984",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Reflected in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3783",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Reflected in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
            }
          ]
        },
        "source": {
          "advisory": "b688e553-d0d9-4ddf-95a3-ff4b78004984",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3783",
    "datePublished": "2021-09-15T12:00:18.000Z",
    "dateReserved": "2021-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:08.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3734 (GCVE-0-2021-3734)

Vulnerability from nvd – Published: 2021-08-26 12:48 – Updated: 2024-08-03 17:01

Title

Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

Summary

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be1…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/0a70acdcf…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , ≤ 1.8.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-26T12:48:50.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
        }
      ],
      "source": {
        "advisory": "dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Restriction of Rendered UI Layers or Frames in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3734",
          "STATE": "PUBLIC",
          "TITLE": "Improper Restriction of Rendered UI Layers or Frames in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
            }
          ]
        },
        "source": {
          "advisory": "dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3734",
    "datePublished": "2021-08-26T12:48:50.000Z",
    "dateReserved": "2021-08-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:01:08.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-27388 (GCVE-0-2020-27388)

Vulnerability from nvd – Published: 2020-10-23 19:59 – Updated: 2026-07-09 00:11

Summary

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

2 references

URL	Tags
https://johnjhacking.com/blog/cve-2020-27388/
https://github.com/YOURLS/YOURLS/pull/2761

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:11:37.770Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://johnjhacking.com/blog/cve-2020-27388/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/pull/2761"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-04T23:54:08.874Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://johnjhacking.com/blog/cve-2020-27388/"
        },
        {
          "url": "https://github.com/YOURLS/YOURLS/pull/2761"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-27388",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://yourls.com",
              "refsource": "MISC",
              "url": "http://yourls.com"
            },
            {
              "name": "https://johnjhacking.com/blog/cve-2020-27388/",
              "refsource": "MISC",
              "url": "https://johnjhacking.com/blog/cve-2020-27388/"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/pull/2761",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/pull/2761"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-27388",
    "datePublished": "2020-10-23T19:59:37.000Z",
    "dateReserved": "2020-10-21T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:11:37.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2019-14537 (GCVE-0-2019-14537)

Vulnerability from nvd – Published: 2019-08-07 16:43 – Updated: 2024-08-05 00:19

Summary

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/YOURLS/YOURLS/releases	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commits/master	x_refsource_MISC
https://github.com/YOURLS/YOURLS/pull/2542	x_refsource_MISC
https://github.com/Wocanilo/CVE-2019-14537	x_refsource_MISC
https://security-garage.com/index.php/cves/cve-20…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.266Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/releases"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/commits/master"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/pull/2542"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Wocanilo/CVE-2019-14537"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-09T12:26:04.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commits/master"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/2542"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Wocanilo/CVE-2019-14537"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-14537",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/YOURLS/YOURLS/releases",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/releases"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/commits/master",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/commits/master"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/pull/2542",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/pull/2542"
            },
            {
              "name": "https://github.com/Wocanilo/CVE-2019-14537",
              "refsource": "MISC",
              "url": "https://github.com/Wocanilo/CVE-2019-14537"
            },
            {
              "name": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling",
              "refsource": "MISC",
              "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-14537",
    "datePublished": "2019-08-07T16:43:52.000Z",
    "dateReserved": "2019-08-02T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-8488 (GCVE-0-2014-8488)

Vulnerability from nvd – Published: 2014-12-10 01:00 – Updated: 2024-08-06 13:18

Summary

Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

4 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://seclists.org/fulldisclosure/2014/Oct/111	mailing-listx_refsource_FULLDISC

Date Public

2014-10-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:18:48.494Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-5965",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
          },
          {
            "name": "FEDORA-2015-5972",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
          },
          {
            "name": "FEDORA-2015-6002",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
          },
          {
            "name": "20141025 Yourls XSS Stored",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-05-04T18:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-5965",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
        },
        {
          "name": "FEDORA-2015-5972",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
        },
        {
          "name": "FEDORA-2015-6002",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
        },
        {
          "name": "20141025 Yourls XSS Stored",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-8488",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-5965",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
            },
            {
              "name": "FEDORA-2015-5972",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
            },
            {
              "name": "FEDORA-2015-6002",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
            },
            {
              "name": "20141025 Yourls XSS Stored",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-8488",
    "datePublished": "2014-12-10T01:00:00.000Z",
    "dateReserved": "2014-10-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:18:48.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-3824 (GCVE-0-2011-3824)

Vulnerability from nvd – Published: 2011-09-24 00:00 – Updated: 2024-09-16 23:20

Summary

Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

3 references

URL	Tags
http://www.openwall.com/lists/oss-security/2011/06/27/6	mailing-listx_refsource_MLIST
http://code.google.com/p/inspathx/source/browse/t…	x_refsource_MISC
http://code.google.com/p/inspathx/source/browse/t…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:46:03.071Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-09-24T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-3824",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
            },
            {
              "name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5",
              "refsource": "MISC",
              "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
            },
            {
              "name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README",
              "refsource": "MISC",
              "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-3824",
    "datePublished": "2011-09-24T00:00:00.000Z",
    "dateReserved": "2011-09-23T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:20:35.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-62858 (GCVE-0-2026-62858)

Vulnerability from cvelistv5 – Published: 2026-10-14 15:42 – Updated: 2026-10-14 17:47

Title

YOURLS: Unauthenticated File Inclusion

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 17:46 UTC

CWE

CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7609 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/YOURLS/YOURLS/security/advisor…	x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4142	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/4e8597216…	x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
YOURLS	YOURLS	Affected: < 1.10.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62858",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:46:13.681061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:47:22.055Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:42:51.362Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/pull/4142",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/4142"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.5"
        }
      ],
      "source": {
        "advisory": "GHSA-f8ff-652m-j5rx",
        "discovery": "UNKNOWN"
      },
      "title": "YOURLS: Unauthenticated File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62858",
    "datePublished": "2026-10-14T15:42:51.362Z",
    "dateReserved": "2026-07-14T21:10:50.032Z",
    "dateUpdated": "2026-10-14T17:47:22.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63135 (GCVE-0-2026-63135)

Vulnerability from cvelistv5 – Published: 2026-08-21 20:40 – Updated: 2026-08-26 17:40

Title

YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

Summary

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 17:40 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7609 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/YOURLS/YOURLS/security/advisor…	x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4107	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/e1e934766…	x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
YOURLS	YOURLS	Affected: >= 1.5.1, < 1.10.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63135",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:40:19.146156Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:40:42.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "YOURLS",
          "vendor": "YOURLS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.1, \u003c 1.10.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T20:40:08.199Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/pull/4107",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/4107"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7"
        },
        {
          "name": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.4"
        }
      ],
      "source": {
        "advisory": "GHSA-5h77-88j3-r659",
        "discovery": "UNKNOWN"
      },
      "title": "YOURLS: Stored XSS in referrer statistics chart via crafted Referer header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63135",
    "datePublished": "2026-08-21T20:40:08.199Z",
    "dateReserved": "2026-07-15T16:54:55.817Z",
    "dateUpdated": "2026-08-26T17:40:42.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-0088 (GCVE-0-2022-0088)

Vulnerability from cvelistv5 – Published: 2022-04-03 08:50 – Updated: 2026-02-16 14:48

Title

Cross-Site Request Forgery (CSRF) in yourls/yourls

Summary

Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://huntr.dev/bounties/d01f0726-1a0f-4575-ae1…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/1de256d86…	x_refsource_MISC
https://github.com/MarkLee131/awesome-web-pocs/bl…

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , < 1.8.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-16T14:48:06.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2022-0088.md"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThan": "1.8.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-03T08:50:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
        }
      ],
      "source": {
        "advisory": "d01f0726-1a0f-4575-ae17-4b5319b11c29",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Request Forgery (CSRF) in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0088",
          "STATE": "PUBLIC",
          "TITLE": "Cross-Site Request Forgery (CSRF) in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.8.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59"
            }
          ]
        },
        "source": {
          "advisory": "d01f0726-1a0f-4575-ae17-4b5319b11c29",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0088",
    "datePublished": "2022-04-03T08:50:10.000Z",
    "dateReserved": "2022-01-04T00:00:00.000Z",
    "dateUpdated": "2026-02-16T14:48:06.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-3785 (GCVE-0-2021-3785)

Vulnerability from cvelistv5 – Published: 2021-09-15 12:05 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in yourls/yourls

Summary

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/b4085d13-54fa-4419-a2c…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/1d8e224eb…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , < 1.8.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThan": "1.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-15T12:05:13.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
        }
      ],
      "source": {
        "advisory": "b4085d13-54fa-4419-a2ce-1d780cc31638",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3785",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/b4085d13-54fa-4419-a2ce-1d780cc31638"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/1d8e224ebabb8a4c75b97f026950ed710faab0ff"
            }
          ]
        },
        "source": {
          "advisory": "b4085d13-54fa-4419-a2ce-1d780cc31638",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3785",
    "datePublished": "2021-09-15T12:05:13.000Z",
    "dateReserved": "2021-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3783 (GCVE-0-2021-3783)

Vulnerability from cvelistv5 – Published: 2021-09-15 12:00 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Reflected in yourls/yourls

Summary

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

6.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/94f6bab91…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , ≤ 1.8.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:08.880Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThanOrEqual": "1.8.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-15T12:00:18.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
        }
      ],
      "source": {
        "advisory": "b688e553-d0d9-4ddf-95a3-ff4b78004984",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Reflected in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3783",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Reflected in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.8.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/b688e553-d0d9-4ddf-95a3-ff4b78004984"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/94f6bab91182142c96ff11f481585b445449efd4"
            }
          ]
        },
        "source": {
          "advisory": "b688e553-d0d9-4ddf-95a3-ff4b78004984",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3783",
    "datePublished": "2021-09-15T12:00:18.000Z",
    "dateReserved": "2021-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:08.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3734 (GCVE-0-2021-3734)

Vulnerability from cvelistv5 – Published: 2021-08-26 12:48 – Updated: 2024-08-03 17:01

Title

Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

Summary

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

Assigner

@huntrdev CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be1…	x_refsource_CONFIRM
https://github.com/yourls/yourls/commit/0a70acdcf…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yourls	yourls/yourls	Affected: unspecified , ≤ 1.8.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yourls/yourls",
          "vendor": "yourls",
          "versions": [
            {
              "lessThanOrEqual": "1.8.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1021",
              "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-26T12:48:50.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
        }
      ],
      "source": {
        "advisory": "dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Restriction of Rendered UI Layers or Frames in yourls/yourls",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3734",
          "STATE": "PUBLIC",
          "TITLE": "Improper Restriction of Rendered UI Layers or Frames in yourls/yourls"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yourls/yourls",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "1.8.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yourls"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/dd2e2dbe-efe5-49ec-be11-7a7e7c41debd"
            },
            {
              "name": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe",
              "refsource": "MISC",
              "url": "https://github.com/yourls/yourls/commit/0a70acdcfb5fcbc63dbc5750018d608288eba3fe"
            }
          ]
        },
        "source": {
          "advisory": "dd2e2dbe-efe5-49ec-be11-7a7e7c41debd",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3734",
    "datePublished": "2021-08-26T12:48:50.000Z",
    "dateReserved": "2021-08-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:01:08.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-27388 (GCVE-0-2020-27388)

Vulnerability from cvelistv5 – Published: 2020-10-23 19:59 – Updated: 2026-07-09 00:11

Summary

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

2 references

URL	Tags
https://johnjhacking.com/blog/cve-2020-27388/
https://github.com/YOURLS/YOURLS/pull/2761

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:11:37.770Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://johnjhacking.com/blog/cve-2020-27388/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/pull/2761"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-04T23:54:08.874Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://johnjhacking.com/blog/cve-2020-27388/"
        },
        {
          "url": "https://github.com/YOURLS/YOURLS/pull/2761"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-27388",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://yourls.com",
              "refsource": "MISC",
              "url": "http://yourls.com"
            },
            {
              "name": "https://johnjhacking.com/blog/cve-2020-27388/",
              "refsource": "MISC",
              "url": "https://johnjhacking.com/blog/cve-2020-27388/"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/pull/2761",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/pull/2761"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-27388",
    "datePublished": "2020-10-23T19:59:37.000Z",
    "dateReserved": "2020-10-21T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:11:37.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2019-14537 (GCVE-0-2019-14537)

Vulnerability from cvelistv5 – Published: 2019-08-07 16:43 – Updated: 2024-08-05 00:19

Summary

YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/YOURLS/YOURLS/releases	x_refsource_MISC
https://github.com/YOURLS/YOURLS/commits/master	x_refsource_MISC
https://github.com/YOURLS/YOURLS/pull/2542	x_refsource_MISC
https://github.com/Wocanilo/CVE-2019-14537	x_refsource_MISC
https://security-garage.com/index.php/cves/cve-20…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:19:41.266Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/releases"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/commits/master"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/YOURLS/YOURLS/pull/2542"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Wocanilo/CVE-2019-14537"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-09T12:26:04.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/releases"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/commits/master"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/YOURLS/YOURLS/pull/2542"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Wocanilo/CVE-2019-14537"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-14537",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/YOURLS/YOURLS/releases",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/releases"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/commits/master",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/commits/master"
            },
            {
              "name": "https://github.com/YOURLS/YOURLS/pull/2542",
              "refsource": "MISC",
              "url": "https://github.com/YOURLS/YOURLS/pull/2542"
            },
            {
              "name": "https://github.com/Wocanilo/CVE-2019-14537",
              "refsource": "MISC",
              "url": "https://github.com/Wocanilo/CVE-2019-14537"
            },
            {
              "name": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling",
              "refsource": "MISC",
              "url": "https://security-garage.com/index.php/cves/cve-2019-14537-api-authentication-bypass-via-type-juggling"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-14537",
    "datePublished": "2019-08-07T16:43:52.000Z",
    "dateReserved": "2019-08-02T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:19:41.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-8488 (GCVE-0-2014-8488)

Vulnerability from cvelistv5 – Published: 2014-12-10 01:00 – Updated: 2024-08-06 13:18

Summary

Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

4 references

URL	Tags
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://seclists.org/fulldisclosure/2014/Oct/111	mailing-listx_refsource_FULLDISC

Date Public

2014-10-25 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:18:48.494Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2015-5965",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
          },
          {
            "name": "FEDORA-2015-5972",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
          },
          {
            "name": "FEDORA-2015-6002",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
          },
          {
            "name": "20141025 Yourls XSS Stored",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-05-04T18:57:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2015-5965",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
        },
        {
          "name": "FEDORA-2015-5972",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
        },
        {
          "name": "FEDORA-2015-6002",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
        },
        {
          "name": "20141025 Yourls XSS Stored",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-8488",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2015-5965",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156596.html"
            },
            {
              "name": "FEDORA-2015-5972",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156526.html"
            },
            {
              "name": "FEDORA-2015-6002",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156564.html"
            },
            {
              "name": "20141025 Yourls XSS Stored",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Oct/111"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-8488",
    "datePublished": "2014-12-10T01:00:00.000Z",
    "dateReserved": "2014-10-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:18:48.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-3824 (GCVE-0-2011-3824)

Vulnerability from cvelistv5 – Published: 2011-09-24 00:00 – Updated: 2024-09-16 23:20

Summary

Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

3 references

URL	Tags
http://www.openwall.com/lists/oss-security/2011/06/27/6	mailing-listx_refsource_MLIST
http://code.google.com/p/inspathx/source/browse/t…	x_refsource_MISC
http://code.google.com/p/inspathx/source/browse/t…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:46:03.071Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-09-24T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-3824",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
            },
            {
              "name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5",
              "refsource": "MISC",
              "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/yourls-1.5"
            },
            {
              "name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README",
              "refsource": "MISC",
              "url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-3824",
    "datePublished": "2011-09-24T00:00:00.000Z",
    "dateReserved": "2011-09-23T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:20:35.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

20 vulnerabilities found for YOURLS by YOURLS

CVE-2026-62858 (GCVE-0-2026-62858)

CVE-2026-63135 (GCVE-0-2026-63135)

CVE-2022-0088 (GCVE-0-2022-0088)

CVE-2021-3785 (GCVE-0-2021-3785)

CVE-2021-3783 (GCVE-0-2021-3783)

CVE-2021-3734 (GCVE-0-2021-3734)

CVE-2020-27388 (GCVE-0-2020-27388)

CVE-2019-14537 (GCVE-0-2019-14537)

CVE-2014-8488 (GCVE-0-2014-8488)

CVE-2011-3824 (GCVE-0-2011-3824)

CVE-2026-62858 (GCVE-0-2026-62858)

CVE-2026-63135 (GCVE-0-2026-63135)

CVE-2022-0088 (GCVE-0-2022-0088)

CVE-2021-3785 (GCVE-0-2021-3785)

CVE-2021-3783 (GCVE-0-2021-3783)

CVE-2021-3734 (GCVE-0-2021-3734)

CVE-2020-27388 (GCVE-0-2020-27388)

CVE-2019-14537 (GCVE-0-2019-14537)

CVE-2014-8488 (GCVE-0-2014-8488)

CVE-2011-3824 (GCVE-0-2011-3824)