CVE-2026-73850 | | | 2026-08-14 | Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php. |
CVE-2026-73849 | Critical | 9.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the… |
CVE-2026-73847 | Medium | 6.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a… |
CVE-2026-67598 | High | 7.4 | 2026-08-03 | Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to inter… |
CVE-2026-46687 | | | 2026-07-16 | Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_co… |
CVE-2026-46686 | | | 2026-07-16 | Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is process… |
CVE-2026-39276 | High | 7.2 | 2026-05-29 | The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By upl… |
CVE-2026-42287 | | | 2026-05-08 | Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to exe… |
CVE-2026-42286 | | | 2026-05-08 | Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authent… |
CVE-2026-41517 | | | 2026-05-08 | Emlog is an open source website building system. Prior to version 2.6.11, insecure plugin upload functionality allows attackers to upload and execute arbitrary… |
CVE-2026-34788 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168… |
CVE-2026-34787 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php at line 80… |
CVE-2026-34607 | High | 7.2 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function (include/lib/comm… |
CVE-2026-34229 | Medium | 6.1 | 2026-04-03 | Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via… |
CVE-2026-34228 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. Prior to version 2.6.8, the backend upgrade interface accepts remote SQL and ZIP URLs via GET parameters. The… |
CVE-2026-31954 | Unrated | | 2026-03-11 | Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), e… |
CVE-2026-22799 | High | 8.8 | 2026-01-12 | Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The… |
CVE-2026-21433 | High | 7.7 | 2026-01-02 | Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requests / SSRF via upload… |
CVE-2026-21432 | Medium | 5.4 | 2026-01-02 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including ta… |
CVE-2026-21431 | Medium | 5.4 | 2026-01-02 | Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while… |
CVE-2026-21430 | Critical | 9.3 | 2026-01-02 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can… |
CVE-2026-21429 | Medium | 4.3 | 2026-01-02 | Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after… |
CVE-2025-61318 | Critical | 9.1 | 2025-12-08 | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php componen… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2025-61930 | High | 8.1 | 2025-10-10 | Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password chan… |
CVE-2025-61769 | Medium | 6.1 | 2025-10-06 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated re… |
CVE-2025-60448 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file… |
CVE-2025-60447 | Medium | 5.9 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration compone… |
CVE-2025-61599 | Medium | 5.4 | 2025-10-03 | Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below… |
CVE-2025-61597 | High | 7.6 | 2025-10-03 | Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail… |
CVE-2025-9296 | Medium | 4.7 | 2025-08-21 | A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Suc… |
CVE-2025-44139 | High | 7.2 | 2025-08-01 | Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip |
CVE-2025-53926 | Medium | 6.1 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-53925 | Medium | 5.4 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-53924 | Medium | 6.9 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote… |
CVE-2025-53923 | High | 8.2 | 2025-07-16 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to… |
CVE-2025-5886 | Low | 3.5 | 2025-06-09 | A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The ma… |
CVE-2025-5119 | High | 7.3 | 2025-05-23 | A vulnerability has been found in Emlog Pro 2.5.11 and classified as critical. This vulnerability affects unknown code of the file /include/controller/api_cont… |
CVE-2025-47787 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a cri… |
CVE-2025-47786 | Medium | 4.8 | 2025-05-15 | Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct ma… |
CVE-2025-47785 | High | 8.3 | 2025-05-15 | Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articl… |
CVE-2025-47784 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nicknam… |
CVE-2025-30372 | Critical | 9.8 | 2025-03-28 | Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` doe… |
CVE-2025-29405 | Medium | 6.3 | 2025-03-19 | An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via upl… |
CVE-2025-29401 | Critical | 9.8 | 2025-03-19 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-25827 | Medium | 6.8 | 2025-02-26 | A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted UR… |
CVE-2025-25825 | High | 7.1 | 2025-02-26 | A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into t… |
CVE-2025-25823 | High | 7.3 | 2025-02-26 | A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into t… |
CVE-2025-25818 | Medium | 5.1 | 2025-02-26 | A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into t… |
CVE-2025-25783 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2024-13140 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=upload… |
CVE-2024-13135 | Low | 3.5 | 2025-01-05 | A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/… |
CVE-2024-13132 | Low | 3.5 | 2025-01-05 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3. This vulnerability affects unknown code of the file /admin/article.php of the com… |
CVE-2024-12846 | Medium | 4.3 | 2024-12-21 | A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file… |
CVE-2024-12845 | Low | 3.5 | 2024-12-20 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /includ… |
CVE-2024-12844 | Medium | 4.3 | 2024-12-20 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulati… |
CVE-2024-12843 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php… |
CVE-2024-12842 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. T… |
CVE-2024-12841 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipul… |
CVE-2024-50655 | Medium | 5.4 | 2024-11-15 | emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published articles. |
CVE-2024-46540 | Medium | 6.3 | 2024-09-30 | A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and sel… |
CVE-2024-31612 | Medium | 6.5 | 2024-06-10 | Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information. |
CVE-2024-5044 | Low | 3.7 | 2024-05-17 | A vulnerability was found in Emlog Pro 2.3.4. It has been classified as problematic. This affects an unknown part of the component Cookie Handler. The manipula… |
CVE-2024-5043 | Medium | 4.7 | 2024-05-17 | A vulnerability was found in Emlog Pro 2.3.4 and classified as critical. Affected by this issue is some unknown functionality of the file admin/setting.php. Th… |
CVE-2024-33752 | Medium | 6.3 | 2024-05-06 | An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote attacker to submit… |
CVE-2024-3763 | Low | 2.4 | 2024-04-14 | A vulnerability was found in Emlog Pro 2.2.10. It has been rated as problematic. This issue affects some unknown processing of the file /admin/tag.php of the c… |
CVE-2024-3762 | Low | 2.4 | 2024-04-14 | A vulnerability was found in Emlog Pro 2.2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/twitter.php of t… |
CVE-2024-31013 | Medium | 6.1 | 2024-04-03 | Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to the bottom of the… |
CVE-2024-25381 | Medium | 6.1 | 2024-02-21 | There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content. |
CVE-2023-41619 | Medium | 6.1 | 2024-01-16 | Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write. |
CVE-2023-41618 | Medium | 6.1 | 2023-12-14 | Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?active_savedraft. |
CVE-2023-41621 | Medium | 6.1 | 2023-12-13 | A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php. |
CVE-2023-41623 | High | 7.2 | 2023-12-12 | Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php. |
CVE-2023-44974 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2023-44973 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2023-43267 | Medium | 5.4 | 2023-10-02 | A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-43291 | Critical | 9.8 | 2023-09-27 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. |
CVE-2023-39121 | High | 7.2 | 2023-08-03 | emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php. |
CVE-2023-37049 | Medium | 6.5 | 2023-07-26 | emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php. |
CVE-2020-19028 | High | 7.5 | 2023-06-05 | *File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function. |
CVE-2023-30338 | Medium | 5.4 | 2023-04-27 | Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2022-3968 | Low | 3.5 | 2022-11-13 | A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_sav… |
CVE-2022-43372 | Medium | 4.8 | 2022-11-03 | Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php. |
CVE-2022-42189 | High | 7.2 | 2022-10-21 | Emlog Pro 1.6.0 plugins upload suffers from a remote code execution (RCE) vulnerability. |
CVE-2022-1526 | Low | 3.5 | 2022-04-29 | A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulatio… |
CVE-2022-23379 | Critical | 9.8 | 2022-02-04 | Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). |
CVE-2022-23872 | Medium | 4.8 | 2022-01-31 | Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_inf… |
CVE-2021-44584 | Medium | 6.1 | 2022-01-06 | Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s pa… |
CVE-2021-40883 | Critical | 9.8 | 2021-12-14 | A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. |
CVE-2020-21654 | High | 7.2 | 2021-10-06 | emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file. |
CVE-2020-21014 | Medium | 6.5 | 2021-10-01 | emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php. |
CVE-2020-21013 | High | 7.2 | 2021-10-01 | emlog v6.0.0 contains a SQL injection via /admin/comment.php. |
CVE-2020-21321 | Medium | 4.3 | 2021-09-15 | emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articles. |
CVE-2021-30081 | High | 8.8 | 2021-05-24 | An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via adm… |
CVE-2020-18194 | Medium | 6.1 | 2021-05-17 | Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post. |
CVE-2021-31737 | Critical | 9.8 | 2021-05-06 | emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. |
CVE-2021-30227 | Medium | 6.1 | 2021-04-29 | Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0. |
CVE-2020-21585 | Critical | 9.8 | 2021-04-02 | Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module. |
CVE-2021-3293 | Medium | 5.3 | 2021-02-08 | emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file. |
CVE-2019-17073 | Medium | 6.5 | 2019-10-01 | emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal. |