Vulnerability · Published Jul 16, 2025 · Assigned by GitHub_M

CVE-2025-53925Emlog has Stored Cross-site Scripting vulnerability in file upload functionality

Medium 5.4

In plain English

A medium-severity cross-site scripting in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload an .svg file that contains JavaScript code that is later executed. As of time of publication, no known patched versions exist.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= pro-2.5.17

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-x4wj-rhvg-hqr9 x_refsource_CONFIRM