VYPR
← All advisories
None severity0.0NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026

CVE-2026-31954

CVE-2026-31954

Description

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Affected products

3
  • Emlog/Emlog3 versions
    cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*+ 2 more
    • cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*range: <=2.6.6
    • (no CPE)range: <=2.6.6
    • (no CPE)range: <= 2.6.6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.