Tag
The YOURLS URL shortener is vulnerable to stored cross-site scripting (XSS) via the Referer header, allowing unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser context.