Vulnerability · Published Oct 10, 2025 · Assigned by GitHub_M

CVE-2025-61930Emlog Pro has CSRF issue that Enables Admin Password Reset

High 8.1

In plain English

A high-severity cross-site request forgery in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.2%top 87.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	<= pro-2.5.19

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2 x_refsource_CONFIRM