CVE-2025-47786: Emlog vulnerable to Stored Cross-site Scripting
Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly stored in the admincommendperpagenum field of the emlogoptions table in the database. Moreover, the output is not filtered, resulting in the direct output of malicious code. As of time of publication, it is unclear if a patch exists.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47786?
CVE-2025-47786 is classified as a stored cross-site scripting vulnerability, which can potentially allow attackers to execute malicious scripts on victim users' browsers.
How do I fix CVE-2025-47786?
To fix CVE-2025-47786, update Emlog to version 2.5.14 or later, where proper input validation and sanitization have been implemented.
Who is affected by CVE-2025-47786?
Any registered user on Emlog version 2.5.13 is affected by CVE-2025-47786 due to the vulnerability in the comment management functionality.
What could happen if CVE-2025-47786 is exploited?
If CVE-2025-47786 is exploited, attackers can inject malicious JavaScript that may compromise the security of all users visiting the affected website.
Is there a workaround for CVE-2025-47786 if I can't update?
A temporary workaround for CVE-2025-47786 includes disabling user comment functionality until an update can be applied.