CVE-2025-61930: Emlog Pro has CSRF issue that Enables Admin Password Reset
Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61930?
CVE-2025-61930 is considered a high-severity vulnerability due to its potential to allow unauthorized password changes.
How do I fix CVE-2025-61930?
To fix CVE-2025-61930, upgrade Emlog Pro to version 2.5.20 or later to mitigate the CSRF vulnerability.
What type of attack does CVE-2025-61930 involve?
CVE-2025-61930 involves a Cross-Site Request Forgery (CSRF) attack that targets the password change endpoint.
Who is affected by CVE-2025-61930?
Emlog Pro users running version 2.5.19 and earlier are affected by CVE-2025-61930.
What can an attacker achieve with CVE-2025-61930?
An attacker can trick a logged-in administrator into changing their password through a crafted POST request.