SQL Injection in Emlog

CVE-2026-42287

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise…

Vulnerability class: SQL Injection

EPSS: 0.000 (12.3th percentile) — read the EPSS interpretation.

Affected products

  • Emlog — versions < 2.6.11

Weakness classification (CWE)

References