CVE-2025-53926

MEDIUM

6.1

Beschreibung

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the comment and comname parameters. Reflected XSS requires the victim to send POST requests, therefore the victim must be persuaded into clicking into sent URL. As of time of publication, no known patched versions exist.

CVE Details

CVSS v3.1 Bewertung6.1

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht7/16/2025

Zuletzt geandert8/14/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

emlog:emlog

Schwachen (CWE)

CWE-79

Referenzen

https://github.com/emlog/emlog/security/advisories/GHSA-g8jx-pj5p-fm3x(security-advisories@github.com)

https://github.com/emlog/emlog/security/advisories/GHSA-g8jx-pj5p-fm3x(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.