PT-2025-21366 · Emlog · Emlog

Jilaqi2333 · Published 2025-05-15 · Updated 2025-05-15 · CVE-2025-47786

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: Emlog version 2.5.13

Description: Emlog is an open source website building system with a stored cross-site scripting issue. This allows any registered user to construct malicious JavaScript, inducing all website users to click. The /admin/comment.php endpoint is affected, where the perpage num parameter is not validated and is directly stored in the database. The output is not filtered, resulting in the direct output of malicious code.

Recommendations: For Emlog version 2.5.13, as a temporary workaround, consider validating and filtering the perpage num parameter in the /admin/comment.php endpoint to prevent malicious code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-47786

GHSA-82QC-9VG7-2C6C

Affected Products

Emlog

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47786.json · Exploit
• 🔥 https://github.com/emlog/emlog/security/advisories/GHSA-82qc-9vg7-2c6c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47786 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47786 · Vendor Advisory
• https://twitter.com/CVEnew/status/1923103698181378495 · Twitter Post
• https://t.me/cvetracker/23941 · Telegram Post