CVEs we hold for Emlog
Records whose assigning authority named Emlog as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-73850Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Functionemlog CVE-2026-73849emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.emlog CVE-2026-73847Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeoveremlog CVE-2026-67598Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.phpemlog CVE-2026-53758Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitizedemlog CVE-2026-53757Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCEemlog CVE-2026-53756Emlog Blind SQL Injection via Authentication Cookieemlog CVE-2026-42287Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functionsemlog CVE-2026-42286Emlog: Cross-Site Request Forgery in Admin Functionsemlog CVE-2026-41517Emlog: Remote Code Execution via Malicious Plugin Uploademlog CVE-2026-34788Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parametersemlog CVE-2026-34787Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameteremlog CVE-2026-34607Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCEemlog CVE-2026-34229Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypassemlog CVE-2026-34228Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Writeemlog CVE-2026-31954Emlog asynchronous media file deletion missing CSRF protectionemlog CVE-2026-21433Emlog vulnerable to Server-Side Request Forgery (SSRF)emlog CVE-2026-21432Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATOemlog CVE-2026-21431Emlog vulnerable to stored Cross-site Scripting via image nameemlog CVE-2025-9296Emlog Pro blogger.php unrestricted uploadn/a Emlog Pro CVE-2025-62717Emlog Pro session verification code error due to clearing logic erroremlog CVE-2025-61930Emlog Pro has CSRF issue that Enables Admin Password Resetemlog CVE-2025-61769Emlog vulnerable to stored XSS in file upload functionality in emlogemlog CVE-2025-61599Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Inputemlog CVE-2025-61597Emlog Pro is vulnerable to stored XSS attack through HTML template injectionemlog CVE-2025-53926Emlog has Stored Cross-site Scripting vulnerability due to erroremlog CVE-2025-53925Emlog has Stored Cross-site Scripting vulnerability in file upload functionalityemlog CVE-2025-53924Emlog vulnerable to stored Cross-site Scripting in links functionalityemlog CVE-2025-53923Emlog vulnerable to reflected Cross-site Scripting in admin panelemlog CVE-2025-47784Emlog vulnerable to Deserialization of Untrusted Dataemlog CVE-2024-5044Emlog Pro Cookie improper authenticationn/a Emlog Pro CVE-2024-5043Emlog Pro setting.php unrestricted uploadn/a Emlog Pro CVE-2024-3763Emlog Pro Post Tag tag.php cross site scriptingn/a Emlog Pro CVE-2024-3762Emlog Pro Whisper Page twitter.php cross site scriptingn/a Emlog Pro CVE-2024-13140Emlog Pro Cover Upload article.php cross site scriptingn/a Emlog Pro CVE-2024-13135Emlog Pro Subpage twitter.php cross site scriptingn/a Emlog Pro CVE-2024-13132Emlog Pro Subpage article.php cross site scriptingn/a Emlog Pro 55 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.