PT-2025-40525 · Emlog Pro · Emlog Pro

Snowhy77 · Published 2025-10-03 · Updated 2025-10-03 · CVE-2025-60447

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.19

Description A stored Cross-Site Scripting (XSS) issue has been identified. The vulnerability is located in the email template configuration component at the /admin/setting.php?action=mail API endpoint. This allows administrators to input HTML code that is not properly sanitized, resulting in persistent JavaScript execution. The HTML code input by administrators is not validated, enabling the injection of malicious scripts.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60447

Affected Products

Emlog Pro

References · 4

• 🔥 https://snowhy77.github.io/2025/08/21/Stored-XSS-Vulnerability-in-Emlog-Pro-HTML-Injection · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-60447 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60447 · Vendor Advisory
• https://t.me/CVEtracker/34018 · Telegram Post