{"id":"GHSA-pwgg-r6fq-mf94","aliases":["CVE-2020-27388"],"title":"YOURLS Stored Cross Site Scripting (XSS)","description":"Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.","severity":"medium","score":5.4,"published":"2022-05-24T17:32:11.000Z","modified":"2024-02-16T08:10:44.093Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"yourls/yourls","ranges":[{"events":[{"introduced":"1.5"},{"fixed":"1.8"}],"type":"ECOSYSTEM"}],"versions":["1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.9"],"fixed":["1.8"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-27388","https://github.com/YOURLS/YOURLS/pull/2761","https://github.com/YOURLS/YOURLS/pull/2761/commits/93396c14587ece4f3d7bcb654f6d22eb0bae7d74","https://github.com/YOURLS/YOURLS/commit/04495e8b17ffeedb695ef5a64389f6bee15d57fb","https://github.com/YOURLS/YOURLS","https://johnjhacking.com/blog/cve-2020-27388","http://yourls.org"],"sources":[{"name":"OSV","id":"GHSA-pwgg-r6fq-mf94","modified":"2024-02-16T08:10:44.093191Z","url":"https://osv.dev/vulnerability/GHSA-pwgg-r6fq-mf94"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}]}