CVE-2019-14537

YOURLS: CVE-2019-14537 PoC When you get a valid timestamp you will be able to make requests to the api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats&timestamp=VALIDTIMESTAMP Usage usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip CVE-2019-14537 PoC...

PT-2025-62941

Summary The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS PRIVATE is set to false public API mode, this vulnerability can be exploited by any unauthenticated attacker. In...