# yourls/yourls (Packagist) vulnerabilities

8 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/yourls/yourls

## Advisories (8)

### [CVE-2026-62858](https://cve.now/CVE-2026-62858): YOURLS: Unauthenticated File Inclusion

- Severity: Medium 5.3
- Published: Oct 14, 2026
- Affected: fixed in 1.10.5.

### [CVE-2026-63135](https://cve.now/CVE-2026-63135): YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

- Severity: High 8.2
- Published: Aug 21, 2026
- Affected: from 1.5.1, fixed in 1.10.4.

### [CVE-2022-0088](https://cve.now/CVE-2022-0088): Cross-Site Request Forgery (CSRF) in yourls/yourls

- Severity: Low 3.5
- Published: Apr 3, 2022
- Affected: through 1.8.2.

### [CVE-2021-3785](https://cve.now/CVE-2021-3785): Cross-site Scripting (XSS) - Stored in yourls/yourls

- Severity: High 8.8
- Published: Sep 15, 2021
- Affected: fixed in 1.8.2.

### [CVE-2021-3783](https://cve.now/CVE-2021-3783): Cross-site Scripting (XSS) - Reflected in yourls/yourls

- Severity: Medium 6.6
- Published: Sep 15, 2021
- Affected: through 1.8.2.

### [CVE-2021-3734](https://cve.now/CVE-2021-3734): Improper Restriction of Rendered UI Layers or Frames in yourls/yourls

- Severity: Medium 6.5
- Published: Aug 26, 2021
- Affected: through 1.8.1.

### [CVE-2020-27388](https://cve.now/CVE-2020-27388): Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.

- Severity: Unrated
- Published: Oct 23, 2020
- Affected: from 1.5, fixed in 1.8.

### [CVE-2019-14537](https://cve.now/CVE-2019-14537): YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.

- Severity: Unrated
- Published: Aug 7, 2019
- Affected: fixed in 1.7.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/yourls/yourls
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.