Vulnerability · Published Oct 3, 2025 · Assigned by GitHub_M

CVE-2025-61597Emlog Pro is vulnerable to stored XSS attack through HTML template injection

High 7.6

In plain English

A high-severity cross-site scripting in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	< 2.5.22

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

References

https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m x_refsource_CONFIRM
https://github.com/emlog/emlog/pull/179 x_refsource_MISC