Advisories · Technology

emlog.

Every CVE that names emlog among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-73848 CVE record

CVSS 6.9 Medium

Emlog: Stored XSS via Tag Name in Article Editor
- emlog
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-53757 CVE record

CVSS 6.9 Medium

Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE
- emlog
- Path traversal
Not analysed yet 4 Sept 2026
CVE-2026-53758 CVE record

CVSS 8.7 High

Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
- emlog
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-53756 CVE record

CVSS 4.9 Medium

Emlog Blind SQL Injection via Authentication Cookie
- emlog
- SQL injection
Not analysed yet 4 Sept 2026
CVE-2026-73850 CVE record

CVSS 8.6 High

Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
- emlog
- SQL injection
Not analysed yet 14 Aug 2026
CVE-2026-73849 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
- emlog
- Authentication bypass
Not analysed yet 14 Aug 2026
CVE-2026-73847 CVE record

CVSS 6.8 Medium

Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
- emlog
- Cross-site request forgery (CSRF)
- Hard-coded credentials
Not analysed yet 14 Aug 2026
CVE-2026-67598 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
- emlog
- Weak cryptography or TLS
Not analysed yet 3 Aug 2026
CVE-2026-46687 CVE record

CVSS 7.7 High

Emlog Local File Inclusion (LFI)
- emlog
- Path traversal
- File inclusion
Not analysed yet 16 Jul 2026
CVE-2026-46686 CVE record

CVSS 8.5 High

Emlog Reflected Cross-Site Scripting
- emlog
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2026
CVE-2026-42287 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
- emlog
- SQL injection
Not analysed yet 8 May 2026
CVE-2026-42286 CVE record

CVSS 8.4 High

Emlog: Cross-Site Request Forgery in Admin Functions
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 8 May 2026
CVE-2026-41517 CVE record

CVSS 0.0 None

Emlog: Remote Code Execution via Malicious Plugin Upload
- emlog
- Unrestricted file upload
Not analysed yet 8 May 2026
CVE-2026-34788 CVE record

CVSS 6.5 Medium

Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters
- emlog
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-34787 CVE record

CVSS 6.5 Medium

Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter
- emlog
- File inclusion
Not analysed yet 3 Apr 2026
CVE-2026-34607 CVE record

CVSS 7.2 High

Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE
- emlog
- Path traversal
Not analysed yet 3 Apr 2026
CVE-2026-34229 CVE record

CVSS 6.1 Medium

Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass
- emlog
- Cross-site scripting (XSS)
Not analysed yet 3 Apr 2026
CVE-2026-34228 CVE record

CVSS 8.7 High

Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 3 Apr 2026
CVE-2026-31954 CVE record

CVSS 0.0 None

Emlog asynchronous media file deletion missing CSRF protection
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 11 Mar 2026
CVE-2026-22799 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

emlog Arbitrary File Upload Vulnerability
- emlog
- Unrestricted file upload
Not analysed yet 12 Jan 2026
CVE-2026-21433 CVE record

CVSS 7.7 High

Emlog vulnerable to Server-Side Request Forgery (SSRF)
- emlog
- Server-side request forgery (SSRF)
Not analysed yet 2 Jan 2026
CVE-2026-21432 CVE record

CVSS 6.8 Medium

Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO
- emlog
- Cross-site scripting (XSS)
Not analysed yet 2 Jan 2026
CVE-2026-21431 CVE record

CVSS 2.0 Low

Emlog vulnerable to stored Cross-site Scripting via image name
- emlog
- Cross-site scripting (XSS)
Not analysed yet 2 Jan 2026
CVE-2026-21430 CVE record

CVSS 7.0 High

Emlog: CSRF chained with stored XSS leads to ATO
- emlog
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jan 2026
CVE-2026-21429 CVE record

CVSS 2.0 Low

Emlog has Broken Access Control (BAC)
- emlog
- Broken access control
Not analysed yet 2 Jan 2026
CVE-2025-62717 CVE record

CVSS 2.7 Low

Emlog Pro session verification code error due to clearing logic error
- emlog
- Authentication bypass
Not analysed yet 24 Oct 2025
CVE-2025-61930 CVE record

CVSS 8.1 High

Emlog Pro has CSRF issue that Enables Admin Password Reset
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 10 Oct 2025
CVE-2025-61769 CVE record

CVSS 2.1 Low

Emlog vulnerable to stored XSS in file upload functionality in emlog
- emlog
- Cross-site scripting (XSS)
Not analysed yet 6 Oct 2025
CVE-2025-61599 CVE record

CVSS 5.1 Medium

Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input
- emlog
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2025
CVE-2025-61597 CVE record

CVSS 7.6 High

Emlog Pro is vulnerable to stored XSS attack through HTML template injection
- emlog
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2025
CVE-2025-53926 CVE record

CVSS 6.1 Medium

Emlog has Stored Cross-site Scripting vulnerability due to error
- emlog
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2025
CVE-2025-53925 CVE record

CVSS 5.4 Medium

Emlog has Stored Cross-site Scripting vulnerability in file upload functionality
- emlog
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2025
CVE-2025-53924 CVE record

CVSS 6.9 Medium

Emlog vulnerable to stored Cross-site Scripting in links functionality
- emlog
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2025
CVE-2025-53923 CVE record

CVSS 8.2 High

Emlog vulnerable to reflected Cross-site Scripting in admin panel
- emlog
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2025
CVE-2025-5886 CVE record

CVSS 5.1 Medium

Emlog article.php cross site scripting
- Emlog
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 9 Jun 2025
CVE-2025-47786 CVE record

CVSS 1.9 Low

Emlog vulnerable to Stored Cross-site Scripting
- emlog
- Cross-site scripting (XSS)
Not analysed yet 15 May 2025
CVE-2025-47785 CVE record

CVSS 8.3 High

EMLOG SQL Injection Vulnerability
- emlog
- SQL injection
Not analysed yet 15 May 2025
CVE-2025-47787 CVE record

CVSS 8.9 High

Emlog Pro Contains a File Upload Vulnerability
- emlog
- Unrestricted file upload
Not analysed yet 15 May 2025
CVE-2025-47784 CVE record

CVSS 6.6 Medium

Emlog vulnerable to Deserialization of Untrusted Data
- emlog
- Insecure deserialization
Not analysed yet 15 May 2025
CVE-2025-30372 CVE record

CVSS 7.7 High

Emlog Pro contains an SQL injection vulnerability.
- emlog
- SQL injection
Not analysed yet 28 Mar 2025
CVE-2022-3968 CVE record

CVSS 3.5 Low

emlog article_save.php cross site scripting
- emlog
- CWE-707
Not analysed yet 13 Nov 2022