CVE-2020-27388

MediumCVSS 5.4/10Last modified Jul 9, 2026

Description

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2020
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-27397.4Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI). The supported version that is affe CVE-2020-273978.8Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to CVE-2020-27404.6Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a CVE-2020-274027.8The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binar CVE-2020-274036.5A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group C CVE-2020-274065.4Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.CVE-2020-274087.5OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated CVE-2020-274096.1OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname paramet CVE-2020-27416.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-274134.2An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password wh CVE-2020-274145.9Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if CVE-2020-274169.8Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to c