CVE-2026-52520: XSS
Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52520?
CVE-2026-52520 has a risk score of 60, indicating a moderate severity level.
What type of vulnerability is CVE-2026-52520?
CVE-2026-52520 is a stored cross-site scripting (XSS) vulnerability.
How can attackers exploit CVE-2026-52520?
Attackers can exploit CVE-2026-52520 by injecting arbitrary JavaScript code into the article content through the article publishing module.
How do I fix CVE-2026-52520?
To fix CVE-2026-52520, update to a patched version of Emlog CMS that addresses this XSS vulnerability.
Which component of Emlog CMS is affected by CVE-2026-52520?
CVE-2026-52520 affects the article publishing module located at /admin/article.php in Emlog CMS.