Emlog
by Emlog
Source repositories
CVEs (105)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-42287 | Cri | 0.65 | — | 0.00 | May 8, 2026 | Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction.… | ||
| CVE-2023-44974 | Cri | 0.65 | 9.8 | 0.19 | Oct 3, 2023 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. | ||
| CVE-2026-73849 | Cri | 0.64 | 9.8 | — | Aug 14, 2026 | Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname,… | ||
| CVE-2025-30372 | Cri | 0.64 | 9.8 | 0.01 | Mar 28, 2025 | Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This… | ||
| CVE-2025-29401 | Cri | 0.64 | 9.8 | 0.01 | Mar 19, 2025 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file. | ||
| CVE-2025-25783 | Cri | 0.64 | 9.8 | 0.01 | Feb 26, 2025 | An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file. | ||
| CVE-2023-44973 | Cri | 0.64 | 9.8 | 0.01 | Oct 3, 2023 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. | ||
| CVE-2023-43291 | Cri | 0.64 | 9.8 | 0.02 | Sep 27, 2023 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. | ||
| CVE-2022-23379 | Cri | 0.64 | 9.8 | 0.01 | Feb 4, 2022 | Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). | ||
| CVE-2021-40883 | Cri | 0.64 | 9.8 | 0.03 | Dec 14, 2021 | A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. | ||
| CVE-2021-31737 | Cri | 0.64 | 9.8 | 0.04 | May 6, 2021 | emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. | ||
| CVE-2020-21585 | Cri | 0.64 | 9.8 | 0.03 | Apr 2, 2021 | Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module. | ||
| CVE-2019-16868 | Cri | 0.64 | 9.8 | 0.03 | Sep 25, 2019 | emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in the bak[] parameter. | ||
| CVE-2026-21430 | Cri | 0.60 | 9.3 | 0.00 | Jan 2, 2026 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with… | ||
| CVE-2025-61318 | Cri | 0.59 | 9.1 | 0.01 | Dec 8, 2025 | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to… | ||
| CVE-2021-30081 | Hig | 0.57 | 8.8 | 0.01 | May 24, 2021 | An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page. | ||
| CVE-2018-18316 | Hig | 0.57 | 8.8 | 0.01 | Oct 15, 2018 | emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. | ||
| CVE-2026-73850 | Hig | 0.56 | — | — | Aug 14, 2026 | Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php. | ||
| CVE-2026-42286 | Hig | 0.55 | — | 0.00 | May 8, 2026 | Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and… | ||
| CVE-2025-47785 | Hig | 0.54 | 8.3 | 0.01 | May 15, 2025 | Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this… |
- risk 0.65cvss —epss 0.00
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction.…
- risk 0.65cvss 9.8epss 0.19
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- risk 0.64cvss 9.8epss —
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname,…
- risk 0.64cvss 9.8epss 0.01
Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This…
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- risk 0.64cvss 9.8epss 0.02
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component.
- risk 0.64cvss 9.8epss 0.01
Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().
- risk 0.64cvss 9.8epss 0.03
A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.
- risk 0.64cvss 9.8epss 0.04
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php.
- risk 0.64cvss 9.8epss 0.03
Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module.
- risk 0.64cvss 9.8epss 0.03
emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in the bak[] parameter.
- risk 0.60cvss 9.3epss 0.00
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with…
- risk 0.59cvss 9.1epss 0.01
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to…
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.
- risk 0.57cvss 8.8epss 0.01
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI.
- risk 0.56cvss —epss —
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.
- risk 0.55cvss —epss 0.00
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and…
- risk 0.54cvss 8.3epss 0.01
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this…
Page 1 of 6