Vulnerability · Published Jul 16, 2025 · Assigned by GitHub_M

CVE-2025-53926Emlog has Stored Cross-site Scripting vulnerability due to error

Medium 6.1

In plain English

A medium-severity cross-site scripting in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 67.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefore the victim must be persuaded into clicking into sent URL. As of time of publication, no known patched versions exist.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= pro-2.5.17

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-g8jx-pj5p-fm3x x_refsource_CONFIRM