CVE-2025-53923: Emlog vulnerable to reflected Cross-site Scripting in admin panel
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keyword parameter. If one persuades an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of publication, no known patched versions exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53923?
CVE-2025-53923 is rated as a medium severity cross-site scripting vulnerability.
How do I fix CVE-2025-53923?
To fix CVE-2025-53923, upgrade Emlog to version pro-2.5.17 or later.
What types of attacks can exploit CVE-2025-53923?
CVE-2025-53923 can be exploited to execute arbitrary web scripts or HTML through the keyword parameter.
Are all versions of Emlog vulnerable to CVE-2025-53923?
Only Emlog versions prior to pro-2.5.17 are vulnerable to CVE-2025-53923.
What are the potential impacts of CVE-2025-53923?
CVE-2025-53923 can lead to unauthorized actions performed on behalf of users due to the injected scripts.