YOURLS is vulnerable to a stored Cross-site Scripting attack, which could allow an attacker to compromise administrative or user sessions.

This vulnerability is a stored Cross-site Scripting (CWE-79) flaw that occurs due to the improper neutralization of input, allowing an unauthenticated attacker to inject malicious scripts into the application.

Successful exploitation poses a high risk to user accounts, including administrative accounts, potentially leading to session hijacking, unauthorized redirection, or the theft of sensitive session cookies. With a CVSS score of 8.2, this vulnerability demands immediate attention to prevent the compromise of organizational web infrastructure and user trust.

Immediate Action: Upgrade to version 1.10.4 or later to implement the necessary input sanitization fixes.

Proactive Monitoring: Monitor web application logs for suspicious input patterns or requests containing script tags directed at the URL shortening interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads directed at the application.

Public Exploit Available: No (exploit_available: false)

The YOURLS platform must be updated to version 1.10.4 as soon as possible. Administrators should ensure that all instances are patched to mitigate the risk of cross-site scripting attacks that could lead to account takeover and unauthorized administrative actions.