YOURLS has 3 CVEs on record between 2020 and 2026. 2 were published in the last 90 days. The median CVSS is 5.4 (medium). Most affected products: YOURLS (2), yourls/yourls (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-63135High· 8.2YOURLS is a self-hosted, customizable URL shortener written in PHP45CVE-2026-62858Medium· 5.3YOURLS is a self-hosted, customizable URL shortener written in PHP41CVE-2020-27388Medium· 5.4Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.1030
YOURLS vulnerabilities
CVEs affecting YOURLS, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-62858Medium· 5.3PoCYOURLS is a self-hosted, customizable URL shortener written in PHP
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash tra…
CVE-2026-63135High· 8.2YOURLS is a self-hosted, customizable URL shortener written in PHP
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the …
CVE-2020-27388Medium· 5.4Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS is…