Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

yourls/yourls

8 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 3 medium, 1 low
Registry
Packagist

Advisories 8

  • CVE-2026-62858Medium 5.3

    YOURLS: Unauthenticated File Inclusion

    Affected: fixed in 1.10.5.

  • YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

    Affected: from 1.5.1, fixed in 1.10.4.

  • Cross-Site Request Forgery (CSRF) in yourls/yourls

    Affected: through 1.8.2.

  • Cross-site Scripting (XSS) - Stored in yourls/yourls

    Affected: fixed in 1.8.2.

  • CVE-2021-3783Medium 6.6

    Cross-site Scripting (XSS) - Reflected in yourls/yourls

    Affected: through 1.8.2.

  • CVE-2021-3734Medium 6.5

    Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

    Affected: through 1.8.1.

  • Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.

    Affected: from 1.5, fixed in 1.8.

  • YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

    Affected: fixed in 1.7.4.