Unrated severityNVD Advisory· Published Oct 31, 2025· Updated Dec 2, 2025
ELOG user profile missing authorization
CVE-2025-64349
Description
ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.