CVE-2025-30372: Emlog Pro contains an SQL injection vulnerability.
Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. searchcontroller.php does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30372?
The severity of CVE-2025-30372 is considered critical due to its potential for SQL injection attacks.
How do I fix CVE-2025-30372?
To fix CVE-2025-30372, update Emlog Pro to version pro-2.5.9 or later, which addresses the SQL injection vulnerability.
What versions of Emlog Pro are affected by CVE-2025-30372?
Emlog Pro versions pro-2.5.7 and pro-2.5.8 are affected by CVE-2025-30372.
What type of vulnerability is CVE-2025-30372?
CVE-2025-30372 is an SQL injection vulnerability that allows attackers to manipulate database queries.
How can CVE-2025-30372 impact my website?
CVE-2025-30372 can lead to unauthorized access to sensitive data, data modification, or complete database compromise.