150 matches found
CVE-2019-14537
YOURLS: CVE-2019-14537 PoC When you get a valid timestamp you will be able to make requests to the api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats×tamp=VALIDTIMESTAMP Usage usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip CVE-2019-14537 PoC...
EUVD-2026-101285
YOURLS: Unauthenticated File Inclusion...
GHSA-F8FF-652M-J5RX YOURLS: Unauthenticated File Inclusion
Summary YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. Details The vulnerability exists because YOURLS uses URL sanitization functions yourlssanitizeurl,...
YOURLS: Unauthenticated File Inclusion
Summary YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. Details The vulnerability exists because YOURLS uses URL sanitization functions yourlssanitizeurl,...
CVE-2026-62858
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...
CVE-2026-62858 YOURLS: Unauthenticated File Inclusion
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...
CVE-2026-62858 YOURLS: Unauthenticated File Inclusion
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...
CVE-2026-62858
The YOURLS URL shortener (prior to version 1.10.5 ) is vulnerable to an unauthenticated file inclusion flaw. The yourls_get_request() function extracts the request path without proper sanitization, allowing dot and slash traversal sequences to bypass yourls_sanitize_url() and yourls_esc_url(). Th...
PT-2026-114237
Name of the Vulnerable Software and Affected Versions YOURLS versions prior to 1.10.5 Description An unauthenticated remote attacker can perform a directory traversal attack to include and execute local PHP files already present on the server. This occurs because the yourls get request function...
CVE-2026-62858: Improper Control of Filename for Include/Require Statement in PHP Program
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...
CVE-2026-63135
creationtimestamp| type| source ---|---|--- 2026-08-21 22:35:08+00:00| published-proof-of-concept| https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659 2026-08-22 00:31:35+00:00| seen| https://gist.github.com/alon710/208f516547042f21996adfe309317a63 2026-08-22 01:00:43+00:00|...
CVE-2026-63135
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
GHSA-5H77-88J3-R659 YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
Summary YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer...
Cross-site Scripting (XSS)
Overview yourls/yourls is an is a set of PHP scripts that allow you to run Your Own URL Shortener. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the processing of HTTP Referer headers in statistics chart rendering. An attacker can execute arbitrary JavaScript in...
CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
EUVD-2026-64149
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2026-63135
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...