CVE-2020-27388

MediumCVSS 5.4

Published: 23/10/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

Multiple stored XSS vulnerabilities exist in the YOURLS Admin Panel, versions 1.5-1.7.10. An authenticated user can inject malicious code by modifying a PHP plugin and uploading it.

Risk Assessment

An attacker can execute arbitrary scripts in other administrators' browsers, leading to session theft, configuration changes, or data theft.

Recommendation

Immediately update YOURLS to the latest version and restrict plugin modification permissions to trusted users only.

Original NVD description (English source)

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.