Emlog vulnerabilities
We track 31 vulnerabilities in Emlog products across 2 products. 31 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
Latest Emlog vulnerabilities
- 8.7 High severity
emlog: Improper Neutralization of Input During Web Page Generation
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is re
- 8.6 High severity
emlog: Improper Neutralization of Special Elements used in an SQL Command
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.
- 9.8 Critical severity
emlog: Missing Authentication for Critical Functionality
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can s
- 7.4 High severity
emlog: Improper Certificate Validation
Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as
- 7.7 High severity
emlog: Path Traversal: '../filedir'
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include Vi
- 8.5 High severity
emlog: Improper Neutralization of Input During Web Page Generation
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views
- 7.2 High severity
Emlog: Improper Limitation of a Pathname to a Restricted Directory
The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can
- 10.0 Critical severity
emlog: Improper Neutralization of Special Elements used in an SQL Command
Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or syst
- 8.4 High severity
emlog: Cross-Site Request Forgery
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin managemen
- 7.2 High severity
emlog: Improper Limitation of a Pathname to a Restricted Directory
Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/common.php:793). When extracting ZIP archives (plugin/template uploads, backup imports), the function cal
- 7.3 High severity
emlog: Cross-Site Request Forgery
Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.
- 8.8 High severity
emlog: Unrestricted Upload of File with Dangerous Type
Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authen
- 7.7 High severity
emlog: Server-Side Request Forgery
Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via uploaded SVG files. An attacker can upload a crafted SVG to http[:]//emblog/admin/media[.]php which contain
- 9.3 Critical severity
emlog: Improper Neutralization of Input During Web Page Generation
Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, wh
- 9.1 Critical severity
Emlog: Path Traversal: '../filedir'
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allow
- 9.1 Critical severity
emlog: Improper Authentication
Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. Th
- 8.8 High severity
emlog: Cross-Site Request Forgery
Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request t
- 9.8 Critical severity
Emlog Pro: Unrestricted Upload of File with Dangerous Type
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attac
- 9.8 Critical severity
Pro: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_controller.php. The manipulation of the argument tag leads to sql injection. The attack can be initiated
- 9.8 Critical severity
emlog: Unrestricted Upload of File with Dangerous Type
Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugi
- 8.8 High severity
emlog: Improper Neutralization of Special Elements used in an SQL Command
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registe
- 9.8 Critical severity
emlog: Deserialization of Untrusted Data
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to
- 9.8 Critical severity
emlog: Improper Neutralization of Special Elements used in an SQL Command
Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double
- 9.8 Critical severity
Emlog: Improper Control of Generation of Code
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 7.1 High severity
Emlog: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
- 7.3 High severity
Emlog: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
- 9.8 Critical severity
Emlog: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
- 8.1 High severity
Emlog Pro: Improper Authentication
A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipulation of the argument AuthCookie leads to improper authentication. It is possible to initiate the atta
- 8.8 High severity
Emlog Pro: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has bee
- 9.8 Critical severity
Emlog: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 9.8 Critical severity
Emlog: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.