{"id":"GHSA-gx7g-wjxg-jwwj","aliases":["CVE-2022-0088"],"title":"Cross-Site Request Forgery in YOURLS","description":"YOURLS versions 1.8.2 and prior are vulnerable to Cross-Site Request Forgery.","severity":"low","score":3.5,"published":"2022-04-04T00:00:55.000Z","modified":"2026-02-18T23:38:51.044Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yourls/yourls","ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.8.2"}],"type":"ECOSYSTEM"}],"versions":["1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.9","1.8","1.8.1","1.8.2"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-0088","https://github.com/YOURLS/YOURLS/issues/3170","https://github.com/YOURLS/YOURLS/pull/3264","https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59","https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2022-0088.md","https://github.com/yourls/yourls","https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29"],"sources":[{"name":"OSV","id":"GHSA-gx7g-wjxg-jwwj","modified":"2026-02-18T23:38:51.044107Z","url":"https://osv.dev/vulnerability/GHSA-gx7g-wjxg-jwwj"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","score":3.5}]}