Emlog vulnerabilities
40 CVEs and advisories name Emlog as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73848Emlog: Stored XSS via Tag Name in Article Editor
- CVE-2026-53757Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE
- CVE-2026-53758Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
- CVE-2026-53756Emlog Blind SQL Injection via Authentication Cookie
- CVE-2026-73850Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
- CVE-2026-73849emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
- CVE-2026-73847Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
- CVE-2026-67598Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php
- CVE-2026-46687Emlog Local File Inclusion (LFI)
- CVE-2026-46686Emlog Reflected Cross-Site Scripting
- CVE-2026-42287Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
- CVE-2026-42286Emlog: Cross-Site Request Forgery in Admin Functions
- CVE-2026-41517Emlog: Remote Code Execution via Malicious Plugin Upload
- CVE-2026-34788Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters
- CVE-2026-34787Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter
- CVE-2026-34607Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE
- CVE-2026-34229Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass
- CVE-2026-34228Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write
- CVE-2026-31954Emlog asynchronous media file deletion missing CSRF protection
- CVE-2026-22799emlog Arbitrary File Upload Vulnerability
- CVE-2026-21433Emlog vulnerable to Server-Side Request Forgery (SSRF)
- CVE-2026-21432Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO
- CVE-2026-21431Emlog vulnerable to stored Cross-site Scripting via image name
- CVE-2026-21430Emlog: CSRF chained with stored XSS leads to ATO
- CVE-2026-21429Emlog has Broken Access Control (BAC)
- CVE-2025-62717Emlog Pro session verification code error due to clearing logic error
- CVE-2025-61930Emlog Pro has CSRF issue that Enables Admin Password Reset
- CVE-2025-61769Emlog vulnerable to stored XSS in file upload functionality in emlog
- CVE-2025-61599Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input
- CVE-2025-61597Emlog Pro is vulnerable to stored XSS attack through HTML template injection