https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 26 Aug 2026 22:57:02 +0000 https://vulnerability.circl.lu/sighting/153b5066-845f-4ddd-a20e-323338086621/export {"uuid": "153b5066-845f-4ddd-a20e-323338086621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63135", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn365qwwx2l", "content": "\ud83d\udfe0 CVE-2026-63135 - High (8.2)\n\nYOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOUR...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63135/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T01:00:43.670860Z"} {"uuid": "153b5066-845f-4ddd-a20e-323338086621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63135", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn365qwwx2l", "content": "\ud83d\udfe0 CVE-2026-63135 - High (8.2)\n\nYOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOUR...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63135/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T01:00:43.670860Z"} https://vulnerability.circl.lu/sighting/153b5066-845f-4ddd-a20e-323338086621/export Sat, 22 Aug 2026 01:00:43 +0000 https://vulnerability.circl.lu/sighting/4286f619-886f-4ab6-96a8-e3ed9ac1f34a/export {"uuid": "4286f619-886f-4ab6-96a8-e3ed9ac1f34a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63135", "type": "seen", "source": "https://gist.github.com/alon710/208f516547042f21996adfe309317a63", "content": "# CVE-2026-63135: CVE-2026-63135: Stored Cross-Site Scripting (XSS) via Referer Header in YOURLS\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63135\n\n## Summary\nCVE-2026-63135 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting YOURLS (Your Own URL Shortener) versions 1.5.1 up to (but not including) 1.10.4. Unauthenticated remote attackers can inject malicious JavaScript arrays by crafting an HTTP Referer header sent to a short URL redirect. This value is saved in the database logs and executed without context-aware escaping when an administrative user views the corresponding statistics visualization page.\n\n## TL;DR\nUnauthenticated stored XSS in YOURLS via crafted Referer headers allows hijacking administrative browser sessions when administrators view short URL statistics.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (Unauthenticated HTTP Request)\n- **CVSS v3.1 Score**: 8.2 (High)\n- **Exploit Status**: Proof of Concept (PoC) available and verified\n- **CISA KEV Status**: No\n- **Scope Impact**: Changed (Client-side execution on admin origin)\n\n## Affected Systems\n\n- YOURLS (Your Own URL Shortener)\n- **YOURLS**: >= 1.5.1, < 1.10.4 (Fixed in: `1.10.4`)\n\n## Mitigation\n\n- Upgrade YOURLS instances to version 1.10.4 or higher.\n- Enforce private administrative statistics dashboards by configuring YOURLS_PRIVATE_INFOS to true in user/config.php.\n- Configure Web Application Firewall (WAF) filter rules to intercept and block HTTP requests with single quotes or brackets inside the Referer header.\n\n**Remediation Steps:**\n1. 1. Secure a full backup of the YOURLS database and instance configuration files.\n2. 2. Deploy the YOURLS 1.10.4 application update.\n3. 3. Inspect the active database log table (specifically the redirect logging schema) for existing referrers containing suspicious punctuation patterns.\n4. 4. Purge any detected malicious entries from the log history to clean existing databases.\n\n## References\n\n- [GitHub Security Advisory GHSA-5h77-88j3-r659](https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659)\n- [Vulnerability Fix Commit](https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7)\n- [YOURLS Pull Request 4107](https://github.com/YOURLS/YOURLS/pull/4107)\n- [CVE-2026-63135 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63135)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63135) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T00:31:35.491223Z"} {"uuid": "4286f619-886f-4ab6-96a8-e3ed9ac1f34a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63135", "type": "seen", "source": "https://gist.github.com/alon710/208f516547042f21996adfe309317a63", "content": "# CVE-2026-63135: CVE-2026-63135: Stored Cross-Site Scripting (XSS) via Referer Header in YOURLS\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63135\n\n## Summary\nCVE-2026-63135 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting YOURLS (Your Own URL Shortener) versions 1.5.1 up to (but not including) 1.10.4. Unauthenticated remote attackers can inject malicious JavaScript arrays by crafting an HTTP Referer header sent to a short URL redirect. This value is saved in the database logs and executed without context-aware escaping when an administrative user views the corresponding statistics visualization page.\n\n## TL;DR\nUnauthenticated stored XSS in YOURLS via crafted Referer headers allows hijacking administrative browser sessions when administrators view short URL statistics.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79 (Improper Neutralization of Input During Web Page Generation)\n- **Attack Vector**: Network (Unauthenticated HTTP Request)\n- **CVSS v3.1 Score**: 8.2 (High)\n- **Exploit Status**: Proof of Concept (PoC) available and verified\n- **CISA KEV Status**: No\n- **Scope Impact**: Changed (Client-side execution on admin origin)\n\n## Affected Systems\n\n- YOURLS (Your Own URL Shortener)\n- **YOURLS**: >= 1.5.1, < 1.10.4 (Fixed in: `1.10.4`)\n\n## Mitigation\n\n- Upgrade YOURLS instances to version 1.10.4 or higher.\n- Enforce private administrative statistics dashboards by configuring YOURLS_PRIVATE_INFOS to true in user/config.php.\n- Configure Web Application Firewall (WAF) filter rules to intercept and block HTTP requests with single quotes or brackets inside the Referer header.\n\n**Remediation Steps:**\n1. 1. Secure a full backup of the YOURLS database and instance configuration files.\n2. 2. Deploy the YOURLS 1.10.4 application update.\n3. 3. Inspect the active database log table (specifically the redirect logging schema) for existing referrers containing suspicious punctuation patterns.\n4. 4. Purge any detected malicious entries from the log history to clean existing databases.\n\n## References\n\n- [GitHub Security Advisory GHSA-5h77-88j3-r659](https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659)\n- [Vulnerability Fix Commit](https://github.com/YOURLS/YOURLS/commit/e1e93476655107e6caab34e52259eb1c91079ec7)\n- [YOURLS Pull Request 4107](https://github.com/YOURLS/YOURLS/pull/4107)\n- [CVE-2026-63135 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63135)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63135) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T00:31:35.491223Z"} https://vulnerability.circl.lu/sighting/4286f619-886f-4ab6-96a8-e3ed9ac1f34a/export Sat, 22 Aug 2026 00:31:35 +0000 https://vulnerability.circl.lu/sighting/37990846-23a5-4ae9-b2d8-43bf05cc3b7a/export {"uuid": "37990846-23a5-4ae9-b2d8-43bf05cc3b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63135", "type": "published-proof-of-concept", "source": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "content": "", "creation_timestamp": "2026-08-21T22:35:08.143842Z"} {"uuid": "37990846-23a5-4ae9-b2d8-43bf05cc3b7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63135", "type": "published-proof-of-concept", "source": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659", "content": "", "creation_timestamp": "2026-08-21T22:35:08.143842Z"} https://vulnerability.circl.lu/sighting/37990846-23a5-4ae9-b2d8-43bf05cc3b7a/export Fri, 21 Aug 2026 22:35:08 +0000