Description
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
Remediation
References
Related Vulnerabilities
Moodle Incorrect Authorization Vulnerability (CVE-2020-25701)
WordPress Plugin PHP Event Calendar for WordPress Arbitrary File Upload (1.6)
MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3759)
WordPress 4.2.x Multiple Vulnerabilities (4.2 - 4.2.33)
ProjectSend Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2023-53930)