# cve.now: Emlog

The newest entries naming Emlog as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-73848](https://cve.now/CVE-2026-73848.md): Emlog: Stored XSS via Tag Name in Article Editor (CVSS 6.9)
- [CVE-2026-53757](https://cve.now/CVE-2026-53757.md): Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE (CVSS 6.9)
- [CVE-2026-53758](https://cve.now/CVE-2026-53758.md): Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized (CVSS 8.7)
- [CVE-2026-53756](https://cve.now/CVE-2026-53756.md): Emlog Blind SQL Injection via Authentication Cookie (CVSS 4.9)
- [CVE-2026-73850](https://cve.now/CVE-2026-73850.md): Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function (CVSS 8.6)
- [CVE-2026-73849](https://cve.now/CVE-2026-73849.md): emlog allows unauthenticated reinstallation via \`install.php?action=reinstall\`. (CVSS 9.8)
- [CVE-2026-73847](https://cve.now/CVE-2026-73847.md): Emlog: Missing CSRF protection in AI Assistant execute\_tool leads to full database compromise and admin account takeover (CVSS 6.8)
- [CVE-2026-67598](https://cve.now/CVE-2026-67598.md): Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php (CVSS 9.1)
- [CVE-2026-46687](https://cve.now/CVE-2026-46687.md): Emlog Local File Inclusion (LFI) (CVSS 7.7)
- [CVE-2026-46686](https://cve.now/CVE-2026-46686.md): Emlog Reflected Cross-Site Scripting (CVSS 8.5)
- [CVE-2026-42287](https://cve.now/CVE-2026-42287.md): Emlog: SQL Injection Vulnerability in log\_model.php within addLog() and updateLog() Functions (CVSS 10.0)
- [CVE-2026-42286](https://cve.now/CVE-2026-42286.md): Emlog: Cross-Site Request Forgery in Admin Functions (CVSS 8.4)
- [CVE-2026-41517](https://cve.now/CVE-2026-41517.md): Emlog: Remote Code Execution via Malicious Plugin Upload (CVSS 0.0)
- [CVE-2026-34788](https://cve.now/CVE-2026-34788.md): Emlog: SQL Injection in tag\_model::updateTagName() via unsanitized parameters (CVSS 6.5)
- [CVE-2026-34787](https://cve.now/CVE-2026-34787.md): Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter (CVSS 6.5)
- [CVE-2026-34607](https://cve.now/CVE-2026-34607.md): Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE (CVSS 7.2)
- [CVE-2026-34229](https://cve.now/CVE-2026-34229.md): Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass (CVSS 6.1)
- [CVE-2026-34228](https://cve.now/CVE-2026-34228.md): Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write (CVSS 8.7)
- [CVE-2026-31954](https://cve.now/CVE-2026-31954.md): Emlog asynchronous media file deletion missing CSRF protection (CVSS 0.0)
- [CVE-2026-22799](https://cve.now/CVE-2026-22799.md): emlog Arbitrary File Upload Vulnerability (CVSS 9.3)
- [CVE-2026-21433](https://cve.now/CVE-2026-21433.md): Emlog vulnerable to Server-Side Request Forgery (SSRF) (CVSS 7.7)
- [CVE-2026-21432](https://cve.now/CVE-2026-21432.md): Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO (CVSS 6.8)
- [CVE-2026-21431](https://cve.now/CVE-2026-21431.md): Emlog vulnerable to stored Cross-site Scripting via image name (CVSS 2.0)
- [CVE-2026-21430](https://cve.now/CVE-2026-21430.md): Emlog: CSRF chained with stored XSS leads to ATO (CVSS 7.0)
- [CVE-2026-21429](https://cve.now/CVE-2026-21429.md): Emlog has Broken Access Control (BAC) (CVSS 2.0)
- [CVE-2025-62717](https://cve.now/CVE-2025-62717.md): Emlog Pro session verification code error due to clearing logic error (CVSS 2.7)
- [CVE-2025-61930](https://cve.now/CVE-2025-61930.md): Emlog Pro has CSRF issue that Enables Admin Password Reset (CVSS 8.1)
- [CVE-2025-61769](https://cve.now/CVE-2025-61769.md): Emlog vulnerable to stored XSS in file upload functionality in emlog (CVSS 2.1)
- [CVE-2025-61599](https://cve.now/CVE-2025-61599.md): Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input (CVSS 5.1)
- [CVE-2025-61597](https://cve.now/CVE-2025-61597.md): Emlog Pro is vulnerable to stored XSS attack through HTML template injection (CVSS 7.6)
- [CVE-2025-53926](https://cve.now/CVE-2025-53926.md): Emlog has Stored Cross-site Scripting vulnerability due to error (CVSS 6.1)
- [CVE-2025-53925](https://cve.now/CVE-2025-53925.md): Emlog has Stored Cross-site Scripting vulnerability in file upload functionality (CVSS 5.4)
- [CVE-2025-53924](https://cve.now/CVE-2025-53924.md): Emlog vulnerable to stored Cross-site Scripting in links functionality (CVSS 6.9)
- [CVE-2025-53923](https://cve.now/CVE-2025-53923.md): Emlog vulnerable to reflected Cross-site Scripting in admin panel (CVSS 8.2)
- [CVE-2025-5119](https://cve.now/CVE-2025-5119.md): Emlog Pro api\_controller.php sql injection (CVSS 6.9)
- [CVE-2025-47786](https://cve.now/CVE-2025-47786.md): Emlog vulnerable to Stored Cross-site Scripting (CVSS 1.9)
- [CVE-2025-47785](https://cve.now/CVE-2025-47785.md): EMLOG SQL Injection Vulnerability (CVSS 8.3)
- [CVE-2025-47787](https://cve.now/CVE-2025-47787.md): Emlog Pro Contains a File Upload Vulnerability (CVSS 8.9)
- [CVE-2025-47784](https://cve.now/CVE-2025-47784.md): Emlog vulnerable to Deserialization of Untrusted Data (CVSS 6.6)
- [CVE-2025-30372](https://cve.now/CVE-2025-30372.md): Emlog Pro contains an SQL injection vulnerability. (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/emlog
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.