# emlog.

Every CVE that names emlog among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Emlog: Stored XSS via Tag Name in Article Editor](https://agentprime.io/advisories/CVE-2026-73848.md)
  `CVE-2026-73848` · CVE record: emlog emlog · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE](https://agentprime.io/advisories/CVE-2026-53757.md)
  `CVE-2026-53757` · CVE record: emlog emlog · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal
- [Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized](https://agentprime.io/advisories/CVE-2026-53758.md)
  `CVE-2026-53758` · CVE record: emlog emlog · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Emlog Blind SQL Injection via Authentication Cookie](https://agentprime.io/advisories/CVE-2026-53756.md)
  `CVE-2026-53756` · CVE record: emlog emlog · CVSS 4.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection
- [Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function](https://agentprime.io/advisories/CVE-2026-73850.md)
  `CVE-2026-73850` · CVE record: emlog emlog · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: SQL injection
- [emlog allows unauthenticated reinstallation via \`install.php?action=reinstall\`.](https://agentprime.io/advisories/CVE-2026-73849.md)
  `CVE-2026-73849` · CVE record: emlog emlog · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: Authentication bypass
- [Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover](https://agentprime.io/advisories/CVE-2026-73847.md)
  `CVE-2026-73847` · CVE record: emlog emlog · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Cross-site request forgery (CSRF), Hard-coded credentials, CWE-1275
- [Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php](https://agentprime.io/advisories/CVE-2026-67598.md)
  `CVE-2026-67598` · CVE record: emlog emlog · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS
- [Emlog Local File Inclusion (LFI)](https://agentprime.io/advisories/CVE-2026-46687.md)
  `CVE-2026-46687` · CVE record: emlog emlog · CVSS 7.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: Path traversal, File inclusion
- [Emlog Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-46686.md)
  `CVE-2026-46686` · CVE record: emlog emlog · CVSS 8.5 High · Not analysed yet · Published 16 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions](https://agentprime.io/advisories/CVE-2026-42287.md)
  `CVE-2026-42287` · CVE record: emlog emlog · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: SQL injection
- [Emlog: Cross-Site Request Forgery in Admin Functions](https://agentprime.io/advisories/CVE-2026-42286.md)
  `CVE-2026-42286` · CVE record: emlog emlog · CVSS 8.4 High · Not analysed yet · Published 8 May 2026 · Tags: Cross-site request forgery (CSRF)
- [Emlog: Remote Code Execution via Malicious Plugin Upload](https://agentprime.io/advisories/CVE-2026-41517.md)
  `CVE-2026-41517` · CVE record: emlog emlog · CVSS 0.0 None · Not analysed yet · Published 8 May 2026 · Tags: Unrestricted file upload
- [Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters](https://agentprime.io/advisories/CVE-2026-34788.md)
  `CVE-2026-34788` · CVE record: emlog emlog · CVSS 6.5 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: SQL injection
- [Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter](https://agentprime.io/advisories/CVE-2026-34787.md)
  `CVE-2026-34787` · CVE record: emlog emlog · CVSS 6.5 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: File inclusion
- [Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE](https://agentprime.io/advisories/CVE-2026-34607.md)
  `CVE-2026-34607` · CVE record: emlog emlog · CVSS 7.2 High · Not analysed yet · Published 3 Apr 2026 · Tags: Path traversal
- [Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass](https://agentprime.io/advisories/CVE-2026-34229.md)
  `CVE-2026-34229` · CVE record: emlog emlog · CVSS 6.1 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-34228.md)
  `CVE-2026-34228` · CVE record: emlog emlog · CVSS 8.7 High · Not analysed yet · Published 3 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Emlog asynchronous media file deletion missing CSRF protection](https://agentprime.io/advisories/CVE-2026-31954.md)
  `CVE-2026-31954` · CVE record: emlog emlog · CVSS 0.0 None · Not analysed yet · Published 11 Mar 2026 · Tags: Cross-site request forgery (CSRF)
- [emlog Arbitrary File Upload Vulnerability](https://agentprime.io/advisories/CVE-2026-22799.md)
  `CVE-2026-22799` · CVE record: emlog emlog · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2026 · Tags: Unrestricted file upload
- [Emlog vulnerable to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-21433.md)
  `CVE-2026-21433` · CVE record: emlog emlog · CVSS 7.7 High · Not analysed yet · Published 2 Jan 2026 · Tags: Server-side request forgery (SSRF)
- [Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO](https://agentprime.io/advisories/CVE-2026-21432.md)
  `CVE-2026-21432` · CVE record: emlog emlog · CVSS 6.8 Medium · Not analysed yet · Published 2 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Emlog vulnerable to stored Cross-site Scripting via image name](https://agentprime.io/advisories/CVE-2026-21431.md)
  `CVE-2026-21431` · CVE record: emlog emlog · CVSS 2.0 Low · Not analysed yet · Published 2 Jan 2026 · Tags: Cross-site scripting (XSS)
- [Emlog: CSRF chained with stored XSS leads to ATO](https://agentprime.io/advisories/CVE-2026-21430.md)
  `CVE-2026-21430` · CVE record: emlog emlog · CVSS 7.0 High · Not analysed yet · Published 2 Jan 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [Emlog has Broken Access Control (BAC)](https://agentprime.io/advisories/CVE-2026-21429.md)
  `CVE-2026-21429` · CVE record: emlog emlog · CVSS 2.0 Low · Not analysed yet · Published 2 Jan 2026 · Tags: Broken access control
- [Emlog Pro session verification code error due to clearing logic error](https://agentprime.io/advisories/CVE-2025-62717.md)
  `CVE-2025-62717` · CVE record: emlog emlog · CVSS 2.7 Low · Not analysed yet · Published 24 Oct 2025 · Tags: Authentication bypass
- [Emlog Pro has CSRF issue that Enables Admin Password Reset](https://agentprime.io/advisories/CVE-2025-61930.md)
  `CVE-2025-61930` · CVE record: emlog emlog · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site request forgery (CSRF)
- [Emlog vulnerable to stored XSS in file upload functionality in emlog](https://agentprime.io/advisories/CVE-2025-61769.md)
  `CVE-2025-61769` · CVE record: emlog emlog · CVSS 2.1 Low · Not analysed yet · Published 6 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input](https://agentprime.io/advisories/CVE-2025-61599.md)
  `CVE-2025-61599` · CVE record: emlog emlog · CVSS 5.1 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Emlog Pro is vulnerable to stored XSS attack through HTML template injection](https://agentprime.io/advisories/CVE-2025-61597.md)
  `CVE-2025-61597` · CVE record: emlog emlog · CVSS 7.6 High · Not analysed yet · Published 3 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Emlog has Stored Cross-site Scripting vulnerability due to error](https://agentprime.io/advisories/CVE-2025-53926.md)
  `CVE-2025-53926` · CVE record: emlog emlog · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Emlog has Stored Cross-site Scripting vulnerability in file upload functionality](https://agentprime.io/advisories/CVE-2025-53925.md)
  `CVE-2025-53925` · CVE record: emlog emlog · CVSS 5.4 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Emlog vulnerable to stored Cross-site Scripting in links functionality](https://agentprime.io/advisories/CVE-2025-53924.md)
  `CVE-2025-53924` · CVE record: emlog emlog · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Emlog vulnerable to reflected Cross-site Scripting in admin panel](https://agentprime.io/advisories/CVE-2025-53923.md)
  `CVE-2025-53923` · CVE record: emlog emlog · CVSS 8.2 High · Not analysed yet · Published 16 Jul 2025 · Tags: Cross-site scripting (XSS)
- [Emlog article.php cross site scripting](https://agentprime.io/advisories/CVE-2025-5886.md)
  `CVE-2025-5886` · CVE record: Emlog · CVSS 5.1 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Emlog vulnerable to Stored Cross-site Scripting](https://agentprime.io/advisories/CVE-2025-47786.md)
  `CVE-2025-47786` · CVE record: emlog emlog · CVSS 1.9 Low · Not analysed yet · Published 15 May 2025 · Tags: Cross-site scripting (XSS)
- [EMLOG SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-47785.md)
  `CVE-2025-47785` · CVE record: emlog emlog · CVSS 8.3 High · Not analysed yet · Published 15 May 2025 · Tags: SQL injection
- [Emlog Pro Contains a File Upload Vulnerability](https://agentprime.io/advisories/CVE-2025-47787.md)
  `CVE-2025-47787` · CVE record: emlog emlog · CVSS 8.9 High · Not analysed yet · Published 15 May 2025 · Tags: Unrestricted file upload
- [Emlog vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2025-47784.md)
  `CVE-2025-47784` · CVE record: emlog emlog · CVSS 6.6 Medium · Not analysed yet · Published 15 May 2025 · Tags: Insecure deserialization
- [Emlog Pro contains an SQL injection vulnerability.](https://agentprime.io/advisories/CVE-2025-30372.md)
  `CVE-2025-30372` · CVE record: emlog emlog · CVSS 7.7 High · Not analysed yet · Published 28 Mar 2025 · Tags: SQL injection
- [emlog article_save.php cross site scripting](https://agentprime.io/advisories/CVE-2022-3968.md)
  `CVE-2022-3968` · CVE record: unspecified emlog · CVSS 3.5 Low · Not analysed yet · Published 13 Nov 2022 · Tags: CWE-707

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=emlog>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/emlog/>. Everything for agents: <https://agentprime.io/llms.txt>.