#VU125574 Cross-site scripting in Emlog Pro

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125574

#VU125574 Cross-site scripting in Emlog Pro

Published: April 9, 2026 / Updated: April 10, 2026


Vulnerability identifier: #VU125574
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Emlog Pro
Software vendor:
Emlog

Description

The vulnerability allows a remote user to execute arbitrary script in an administrator context.

The vulnerability exists due to cross-site scripting in the article edit page when rendering stored custom field values. A remote user can submit specially crafted field_keys[] and field_values[] data to execute arbitrary script in an administrator context.

User interaction is required when an administrator or editor opens the article edit page.


Remediation

Install security update from vendor's website.

External links