Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
111 results · page 1 of 3
Sep 21, 2026EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.CVE-2026-88745 · Other software · reported by MITREMedium 6.1
EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Emlog is an open source website building system.CVE-2026-73848 · Other software · emlog · reported by GitHubMedium 6.9
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Emlog is an open source website building system.CVE-2026-53758 · Other software · emlog · reported by GitHubHigh 8.7
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Emlog is an open source website building system.CVE-2026-53757 · Other software · emlog · reported by GitHubMedium 6.9
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite arbitrary files on the server filesystem, including config.php for immediate RCE. At time of publication, there are no publicly known patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Emlog is an open source website building system.CVE-2026-53756 · Other software · emlog · reported by GitHubMedium 4.9
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Emlog is an open source website building system.CVE-2026-73850 · Other software · emlog · reported by GitHubHigh 8.6
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Emlog is an open source website building system.CVE-2026-73849 · Other software · emlog · reported by GitHubCritical 9.8
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026Emlog is an open source website building system.CVE-2026-73847 · Other software · emlog · reported by GitHubMedium 6.8
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php).CVE-2026-52520 · Other software · reported by MITREMedium 5.4
Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercCVE-2026-67598 · Other software · emlog · reported by VulnCheckCritical 9.1
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 16, 2026Emlog is an open source website building system.CVE-2026-46687 · Other software · emlog · reported by GitHubHigh 7.7
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026Emlog is an open source website building system.CVE-2026-46686 · Other software · emlog · reported by GitHubHigh 8.5
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code.CVE-2026-39276 · Other software · Emlog · reported by MITREHigh 7.2
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-42287 · Other software · emlog · reported by GitHubCritical 10
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-42286 · Other software · emlog · reported by GitHubHigh 8.4
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026Emlog is an open source website building system.CVE-2026-41517 · Other software · emlog · reported by GitHubNone
Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary PHP code, leading to complete server compromise and persistent backdoor installation. This issue has been patched in version 2.6.11.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34788 · Other software · emlog · reported by GitHubMedium 6.5
Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34787 · Other software · emlog · reported by GitHubMedium 6.5
Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed (see potential bypass conditions), an attacker can include arbitrary PHP files from the server filesystem, leading to code execution. At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34607 · Other software · emlog · reported by GitHubHigh 7.2
Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function calls $zip->extractTo($path) without sanitizing ZIP entry names. An authenticated admin can upload a crafted ZIP containing entries with ../ sequences to write arbitrary files to the server filesystem, including PHP webshells, achieving Remote Code Execution (RCE). At time of publication, there are no publicly available patches.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34229 · Other software · emlog · reported by GitHubMedium 6.1
Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Emlog is an open source website building system.CVE-2026-34228 · Other software · emlog · reported by GitHubHigh 8.7
Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The server first downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root directory. This process does not validate a CSRF token. Therefore, an attacker only needs to trick an authenticated administrator into visiting a malicious link to achieve arbitrary SQL execution and arbitrary file write. This issue has been patched in version 2.6.8.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Emlog is an open source website building system.CVE-2026-31954 · Other software · emlog · reported by GitHubNone
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Emlog is an open source website building system.CVE-2026-22799 · Other software · emlog · reported by GitHubCritical 9.3
Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API setting, or via information disclosure vulnerabilities in the application. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Emlog is an open source website building system.CVE-2026-21433 · Other software · emlog · reported by GitHubHigh 7.7
Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http[:]//emblog/admin/media[.]php which contains external resource references. When the server processes/renders the SVG (thumbnailing, preview, or sanitization), it issues an HTTP request to the attacker-controlled host. Impact: server-side SSRF/OOB leading to internal network probing and potential metadata/credential exposure. As of time of publication, no known patched versions are available.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Emlog is an open source website building system.CVE-2026-21432 · Other software · emlog · reported by GitHubMedium 6.8
Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including takeover of admin accounts. As of time of publication, no known patched versions are available.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Emlog is an open source website building system.CVE-2026-21431 · Other software · emlog · reported by GitHubLow 2
Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article. As of time of publication, no known patched versions are available.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Emlog is an open source website building system.CVE-2026-21430 · Other software · emlog · reported by GitHubHigh 7
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Emlog is an open source website building system.CVE-2026-21429 · Other software · emlog · reported by GitHubLow 2
Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As of time of publication, no known patched versions are available.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability.CVE-2025-61318 · Other software · Emlog · reported by MITRECritical 9.1
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025Emlog is an open source website building system.CVE-2025-62717 · Other software · emlog · reported by GitHubLow 2.7
Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Emlog is an open source website building system.CVE-2025-61930 · Other software · emlog · reported by GitHubHigh 8.1
Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025Emlog is an open source website building system.CVE-2025-61769 · Other software · emlog · reported by GitHubLow 2.1
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload .svg file that contains JavaScript code that is later being executed. Commit 052f9c4226b2c0014bcd857fec47677340b185b1 fixes the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.CVE-2025-60448 · Other software · Emlog · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.CVE-2025-60447 · Other software · Emlog · reported by MITREMedium 5.9
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Emlog is an open source website building system.CVE-2025-61599 · Other software · emlog · reported by GitHubMedium 5.1
Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025Emlog is an open source website building system.CVE-2025-61597 · Other software · emlog · reported by GitHubHigh 7.6
Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025A security vulnerability has been detected in Emlog Pro up to 2.5.18.CVE-2025-9296 · Other software · Emlog · reported by VulDBLow 2
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zipCVE-2025-44139 · Other software · Emlog · reported by MITREHigh 7.2
Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jul 16, 2025Emlog is an open source website building system.CVE-2025-53926 · Other software · emlog · reported by GitHubMedium 6.1
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefore the victim must be persuaded into clicking into sent URL. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Emlog is an open source website building system.CVE-2025-53925 · Other software · emlog · reported by GitHubMedium 5.4
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload an .svg file that contains JavaScript code that is later executed. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Emlog is an open source website building system.CVE-2025-53924 · Other software · emlog · reported by GitHubMedium 6.9
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the siteurl parameter. It is possible to inject malicious code into siteurl parameter resulting in Stored XSS. When someone clicks on the link the malicious code is executed. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025Emlog is an open source website building system.CVE-2025-53923 · Other software · emlog · reported by GitHubHigh 8.2
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keyword parameter. If one persuades an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of publication, no known patched versions exist.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability was found in Emlog up to 2.5.7 and classified as problematic.CVE-2025-5886 · Other software · Emlog · reported by VulDBLow 2
A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The manipulation of the argument active_post leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2025A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical.CVE-2025-5119 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Emlog is an open source website building system.CVE-2025-47787 · Other software · emlog · reported by GitHubHigh 8.9
Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Emlog is an open source website building system.CVE-2025-47786 · Other software · emlog · reported by GitHubLow 1.9
Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In `/admin/comment.php`, the parameter `perpage_num` is not validated and is directly stored in the `admin_commend_perpage_num` field of the `emlog_options` table in the database. Moreover, the output is not filtered, resulting in the direct output of malicious code. As of time of publication, it is unclear if a patch exists.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Emlog is an open source website building system.CVE-2025-47785 · Other software · emlog · reported by GitHubHigh 8.3
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this will cause SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Emlog is an open source website building system.CVE-2025-47784 · Other software · emlog · reported by GitHubMedium 6.6
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Emlog is an open source website building system.CVE-2025-30372 · Other software · emlog · reported by GitHubHigh 7.7
Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploCVE-2025-29405 · Other software · Emlog · reported by MITREMedium 6.3
An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.