Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
111 results · page 2 of 3
Mar 19, 2025An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a craftedCVE-2025-29401 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URLCVE-2025-25827 · Other software · Emlog · reported by MITREMedium 6.8
A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25825 · Other software · Emlog · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25823 · Other software · Emlog · reported by MITREHigh 7.3
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25818 · Other software · Emlog · reported by MITREMedium 5.1
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted CVE-2025-25783 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3.CVE-2024-13140 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic.CVE-2024-13135 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/twitter.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3.CVE-2024-13132 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2024A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1.CVE-2024-12846 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file /admin/link.php. The manipulation of the argument siteurl/icon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1.CVE-2024-12845 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /include/lib/common.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1.CVE-2024-12844 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12843 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12842 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12841 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles.CVE-2024-50655 · Other software · Emlog · reported by MITREMedium 5.4
emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and selfCVE-2024-46540 · Other software · emlog_pro_project · reported by MITREMedium 6.3
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining system privileges.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 13, 2024In memcall_add of memlog.c, there is a possible buffer overflow due to improper input validation.CVE-2024-32907 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In memcall_add of memlog.c, there is a possible buffer overflow due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 10, 2024Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.CVE-2024-31612 · Other software · emlog · reported by MITREMedium 6.5
Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability was found in Emlog Pro 2.3.4.CVE-2024-5044 · Other software · Emlog · reported by VulDBMedium 6.3
A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipulation of the argument AuthCookie leads to improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-264741 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability was found in Emlog Pro 2.3.4 and classified as critical.CVE-2024-5043 · Other software · emlog_pro_project · reported by VulDBMedium 5.1
A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit CVE-2024-33752 · Other software · emlog · reported by MITREMedium 6.3
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024A vulnerability was found in Emlog Pro 2.2.10.CVE-2024-3763 · Other software · emlog_pro_project · reported by VulDBLow 2.4
A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the component Post Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024A vulnerability was found in Emlog Pro 2.2.10.CVE-2024-3762 · Other software · emlog_pro_project · reported by VulDBLow 2.4
A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260602 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to the bottom of the hCVE-2024-31013 · Other software · emlog · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in footer_info parameter.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.CVE-2024-25381 · Other software · emlog_pro_project · reported by MITREMedium 6.1
There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.CVE-2023-41619 · Other software · Emlog · reported by MITREMedium 6.1
Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.CVE-2023-41618 · Other software · Emlog · reported by MITREMedium 6.1
Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.CVE-2023-41621 · Other software · Emlog · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.CVE-2023-41623 · Other software · Emlog · reported by MITREHigh 7.2
Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2023-44974 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftCVE-2023-44973 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a CVE-2023-43267 · Other software · Emlog · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 27, 2023Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.CVE-2023-43291 · Other software · Emlog · reported by MITRECritical 9.8
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 3, 2023emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.CVE-2023-39121 · Other software · Emlog · reported by MITREHigh 7.2
emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.CVE-2023-37049 · Other software · Emlog · reported by MITREMedium 6.5
emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function.CVE-2020-19028 · Other software · Emlog · reported by MITREHigh 7.5
*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-30338 · Other software · Emlog · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022A vulnerability has been found in emlog and classified as problematic.CVE-2022-3968 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.CVE-2022-43372 · Other software · Emlog · reported by MITREMedium 4.8
Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.CVE-2022-42189 · Other software · Emlog · reported by MITREHigh 7.2
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.CVE-2021-40610 · Other software · Emlog Pro Project · reported by MITREMedium 5.4
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
- Product
- Emlog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2.CVE-2022-1526 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.
- Product
- Emlog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().CVE-2022-23379 · Other software · Emlog · reported by MITRECritical 9.8
Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_infoCVE-2022-23872 · Other software · Emlog · reported by MITREMedium 4.8
Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parCVE-2021-44584 · Other software · Emlog · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.CVE-2021-40883 · Other software · Emlog · reported by MITRECritical 9.8
A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2021emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file.CVE-2020-21654 · Other software · Emlog · reported by MITREHigh 7.2
emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.CVE-2020-21014 · Other software · Emlog · reported by MITREMedium 6.5
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021emlog v6.0.0 contains a SQL injection via /admin/comment.php.CVE-2020-21013 · Other software · Emlog · reported by MITREHigh 7.2
emlog v6.0.0 contains a SQL injection via /admin/comment.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.