Emlog Emlog
98 CVEs affecting Emlog Emlog. Latest disclosed: 2026-07-16. Critical: 16, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47787 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a cri… |
CVE-2025-47784 | Critical | 9.8 | 2025-05-15 | Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nicknam… |
CVE-2025-30372 | Critical | 9.8 | 2025-03-28 | Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` doe… |
CVE-2025-29401 | Critical | 9.8 | 2025-03-19 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-25783 | Critical | 9.8 | 2025-02-26 | An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted… |
CVE-2023-44974 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2023-44973 | Critical | 9.8 | 2023-10-03 | An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a craf… |
CVE-2023-43291 | Critical | 9.8 | 2023-09-27 | Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php component. |
CVE-2022-23379 | Critical | 9.8 | 2022-02-04 | Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid(). |
CVE-2021-40883 | Critical | 9.8 | 2021-12-14 | A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. |
CVE-2021-31737 | Critical | 9.8 | 2021-05-06 | emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. |
CVE-2020-21585 | Critical | 9.8 | 2021-04-02 | Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module. |
CVE-2019-16868 | Critical | 9.8 | 2019-09-25 | emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in th… |
CVE-2026-21430 | Critical | 9.3 | 2026-01-02 | Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can… |
CVE-2025-61318 | Critical | 9.1 | 2025-12-08 | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php componen… |
CVE-2025-62717 | Critical | 9.1 | 2025-10-24 | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error… |
CVE-2026-22799 | High | 8.8 | 2026-01-12 | Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The… |
CVE-2021-30081 | High | 8.8 | 2021-05-24 | An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via adm… |
CVE-2018-18316 | High | 8.8 | 2018-10-15 | emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. |
CVE-2025-47785 | High | 8.3 | 2025-05-15 | Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articl… |