105 matches found
CVE-2026-63135
creationtimestamp| type| source ---|---|--- 2026-08-21 22:35:08+00:00| published-proof-of-concept| https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659 2026-08-22 00:31:35+00:00| seen| https://gist.github.com/alon710/208f516547042f21996adfe309317a63 2026-08-22 01:00:43+00:00|...
CVE-2026-63135
YOURLS (self-hosted PHP URL shortener) versions 1.5.1 through 1.10.4 are affected by a stored cross-site scripting (XSS) vulnerability in the referrer statistics chart. The root cause is that the chart builder concatenates referrer-derived domain labels into inline JavaScript without proper strin...
EUVD-2026-64149
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...
CVE-2024-39899
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication toke...
EUVD-2025-205842
YOURLS is vulnerable to XSS through JSONP and Callback request parameters...
GHSA-6MP4-Q625-MXJP YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Summary The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLSPRIVATE is set to false public API mode, this vulnerability can be exploited by any unauthenticated attacker. In...
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Summary The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLSPRIVATE is set to false public API mode, this vulnerability can be exploited by any unauthenticated attacker. In...
📄 YOURLS 1.8.2 SQL Injection
Proof of concept for a remote SQL injection vulnerability in YOURLS version 1.8.2. ============================================================================================================================================= | Title : YOURLS 1.8.2 SQL Injection & System Compromise in Administrati...
📄 YOURLS 1.8.2 CSRF / IDOR / Missing Authorization
YOURLS version 1.8.2 AJAX endpoint scanner that checks for cross site request forgery, insecure direct object reference, missing authorization, and missing input validation vulnerabilities...
📄 YOURLS 1.8.2 Cross Site Request Forgery
YOURLS version 1.8.2 suffers from a cross site request forgery vulnerability. Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery CSRF Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/yourls/yourls/ Software Link: https://github.com/yourls/yourls/ Version: 1.8....
YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
Exploit Title: YOURLS 1.8.2 - Cross-Site Request Forgery CSRF Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/yourls/yourls/ Software Link: https://github.com/yourls/yourls/ Version: 1.8.2 Tested on: Windows CVE : CVE-2022-0088 Proof Of Concept CSRF PoC CSRF Proof ...
EUVD-2011-3781
Malware in sbrugna...
EUVD-2021-2041
Malware in sbrugna...
EUVD-2014-8325
Malware in sbrugna...
EUVD-2021-2092
Malware in sbrugna...
EUVD-2024-2387
Malicious code in bioql PyPI...
EUVD-2022-4837
Malicious code in bioql PyPI...