Vulnerability · Published Mar 28, 2025 · Assigned by GitHub_M

CVE-2025-30372Emlog Pro contains an SQL injection vulnerability.

High 7.7

In plain English

A high-severity SQL injection in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	>= pro-2.5.7, < pro-2.5.9

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/emlog/emlog/security/advisories/GHSA-w6xc-r6x5-m77c x_refsource_CONFIRM