Vulnerability · Published Jul 16, 2025 · Assigned by GitHub_M
CVE-2025-53923Emlog vulnerable to reflected Cross-site Scripting in admin panel
High 8.2
In plain English
A high-severity cross-site scripting in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keyword parameter. If one persuades an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of publication, no known patched versions exist.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
- https://github.com/emlog/emlog/security/advisories/GHSA-vvx2-m94x-f54m x_refsource_CONFIRM