CVE-2025-53926: Emlog has Stored Cross-site Scripting vulnerability due to error
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefore the victim must be persuaded into clicking into sent URL. As of time of publication, no known patched versions exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53926?
CVE-2025-53926 is categorized as a cross-site scripting (XSS) vulnerability which can have a high impact on web security.
How do I fix CVE-2025-53926?
To fix CVE-2025-53926, upgrade Emlog to version 2.5.18 or later where the vulnerability has been addressed.
Who is affected by CVE-2025-53926?
CVE-2025-53926 affects users of Emlog versions up to and including pro-2.5.17.
What types of attacks are possible with CVE-2025-53926?
CVE-2025-53926 allows remote attackers to inject arbitrary web scripts or HTML via comment inputs, potentially leading to data theft or session hijacking.
Is CVE-2025-53926 easy to exploit?
Yes, CVE-2025-53926 can be exploited through reflected XSS, but it requires user interaction such as submitting a form to be effective.