Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Oct 14, 2026YOURLS is a self-hosted, customizable URL shortener written in PHP.CVE-2026-62858 · Other software · YOURLS · reported by GitHubMedium 5.3
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.
- Product
- YOURLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026YOURLS is a self-hosted, customizable URL shortener written in PHP.CVE-2026-63135 · Other software · YOURLS · reported by GitHubHigh 8.2
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.
- Product
- YOURLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2022Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.CVE-2022-0088 · Other software · yourls · reported by security@huntr.devHigh 7.4
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
- Product
- yourls/yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3785 · Other software · yourls · reported by security@huntr.devMedium 5.4
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yourls/yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3783 · Other software · yourls · reported by security@huntr.devMedium 6.1
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- yourls/yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2021yourls is vulnerable to Improper Restriction of Rendered UI Layers or FramesCVE-2021-3734 · Other software · yourls · reported by security@huntr.devHigh 8.8
yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
- Product
- yourls/yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2020Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.CVE-2020-27388 · Other software · Yourls · reported by MITREMedium 5.4
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
- Product
- Yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjohnjhacking.com
Aug 7, 2019YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.CVE-2019-14537 · Other software · Yourls · reported by MITRECritical 9.8
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
- Product
- Yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2014Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that CVE-2014-8488 · Other software · Yourls · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.
- Product
- Yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Sep 23, 2011Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation CVE-2011-3824 · Other software · Yourls · reported by MITREMedium 5
Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.
- Product
- Yourls
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.