Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
47 results
Sep 21, 2026EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.CVE-2026-88745 · Other software · reported by MITREMedium 6.1
EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercCVE-2026-67598 · Other software · emlog · reported by VulnCheckCritical 9.1
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSearchHtml() with no option to re-enable verification. Attackers can perform man-in-the-middle interception to extract Authorization Bearer API keys from every AI request and inject crafted AI responses that may be acted upon by the tool-call execution pipeline, including the query_database and update_config tool handlers.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 29, 2026The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code.CVE-2026-39276 · Other software · Emlog · reported by MITREHigh 7.2
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability.CVE-2025-61318 · Other software · Emlog · reported by MITRECritical 9.1
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.CVE-2025-60448 · Other software · Emlog · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19.CVE-2025-60447 · Other software · Emlog · reported by MITREMedium 5.9
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025A security vulnerability has been detected in Emlog Pro up to 2.5.18.CVE-2025-9296 · Other software · Emlog · reported by VulDBLow 2
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2025Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zipCVE-2025-44139 · Other software · Emlog · reported by MITREHigh 7.2
Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 23, 2025A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical.CVE-2025-5119 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
- Product
- Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploCVE-2025-29405 · Other software · Emlog · reported by MITREMedium 6.3
An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 19, 2025An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a craftedCVE-2025-29401 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URLCVE-2025-25827 · Other software · Emlog · reported by MITREMedium 6.8
A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25825 · Other software · Emlog · reported by MITREHigh 7.1
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25823 · Other software · Emlog · reported by MITREHigh 7.3
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into thCVE-2025-25818 · Other software · Emlog · reported by MITREMedium 5.1
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted CVE-2025-25783 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3.CVE-2024-13140 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload_cover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic.CVE-2024-13135 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/twitter.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3.CVE-2024-13132 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the component Subpage Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2024A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1.CVE-2024-12846 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file /admin/link.php. The manipulation of the argument siteurl/icon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1.CVE-2024-12845 · Other software · Emlog · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /include/lib/common.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1.CVE-2024-12844 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12843 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12842 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2024A vulnerability was found in Emlog Pro up to 2.4.1.CVE-2024-12841 · Other software · Emlog · reported by VulDBMedium 6.9
A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles.CVE-2024-50655 · Other software · Emlog · reported by MITREMedium 5.4
emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and selfCVE-2024-46540 · Other software · emlog_pro_project · reported by MITREMedium 6.3
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining system privileges.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 10, 2024Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.CVE-2024-31612 · Other software · emlog · reported by MITREMedium 6.5
Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability was found in Emlog Pro 2.3.4.CVE-2024-5044 · Other software · Emlog · reported by VulDBMedium 6.3
A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipulation of the argument AuthCookie leads to improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-264741 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A vulnerability was found in Emlog Pro 2.3.4 and classified as critical.CVE-2024-5043 · Other software · emlog_pro_project · reported by VulDBMedium 5.1
A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264740. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit CVE-2024-33752 · Other software · emlog · reported by MITREMedium 6.3
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit a special request to upload a malicious file to execute arbitrary code.
- Product
- emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024A vulnerability was found in Emlog Pro 2.2.10.CVE-2024-3763 · Other software · emlog_pro_project · reported by VulDBLow 2.4
A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the component Post Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2024A vulnerability was found in Emlog Pro 2.2.10.CVE-2024-3762 · Other software · emlog_pro_project · reported by VulDBLow 2.4
A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of the component Whisper Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260602 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.CVE-2024-25381 · Other software · emlog_pro_project · reported by MITREMedium 6.1
There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.
- Product
- emlog_pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.CVE-2023-41619 · Other software · Emlog · reported by MITREMedium 6.1
Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.CVE-2023-41618 · Other software · Emlog · reported by MITREMedium 6.1
Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2023A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.CVE-2023-41621 · Other software · Emlog · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftedCVE-2023-44974 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craftCVE-2023-44973 · Other software · Emlog · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a CVE-2023-43267 · Other software · Emlog · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title field.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 27, 2023Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.CVE-2023-43291 · Other software · Emlog · reported by MITRECritical 9.8
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 27, 2023Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload iCVE-2023-30338 · Other software · Emlog · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.CVE-2022-43372 · Other software · Emlog · reported by MITREMedium 4.8
Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.CVE-2022-42189 · Other software · Emlog · reported by MITREHigh 7.2
Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.CVE-2021-40610 · Other software · Emlog Pro Project · reported by MITREMedium 5.4
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
- Product
- Emlog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2.CVE-2022-1526 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.
- Product
- Emlog Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_infoCVE-2022-23872 · Other software · Emlog · reported by MITREMedium 4.8
Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.
- Product
- Emlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.