GCVE - cpe:2.3:a:emlog:emlog:2.5.23:*:*:*:pro:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:emlog:emlog:2.5.23:*:*:*:pro:*:*:*

part: a version: 2.5.23 update: *

Vendor	Emlog (`9228eccc-8b2e-510f-a8c6-fe256aa9523f`)
Product	Emlog (`8a6106bc-cd8c-52c8-abed-0b208e6a16a7`)
Edition	*
Language	*
Software edition	pro
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/emlog/emlog`	purl2cpe	2026-06-01 10:13:05.510419

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-21432`	vulnerable	2026-06-08 07:49:16.378066	Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takeover, including takeover of admin accounts. As of time of publication, no known patched versions are available. Published: 2026-01-02T18:58:38.050Z Updated: 2026-01-05T20:37:57.632Z Open on db.gcve.eu Reference links https://github.com/emlog/emlog/security/advisories/GHSA-4rxf-mjqx-c464	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-21431`	vulnerable	2026-06-08 07:49:16.377802	Emlog vulnerable to stored Cross-site Scripting via image name Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article. As of time of publication, no known patched versions are available. Published: 2026-01-02T18:49:03.202Z Updated: 2026-01-05T20:38:04.182Z Open on db.gcve.eu Reference links https://github.com/emlog/emlog/security/advisories/GHSA-9vc2-crhr-248x	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-21430`	vulnerable	2026-06-08 07:49:16.377500	Emlog: CSRF chained with stored XSS leads to ATO Emlog is an open source website building system. In version 2.5.23, article creation functionality is vulnerable to cross-site request forgery (CSRF). This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. This, when combined with stored cross-site scripting, leads to account takeover. As of time of publication, no known patched versions are available. Published: 2026-01-02T18:44:24.192Z Updated: 2026-01-05T20:38:09.299Z Open on db.gcve.eu Reference links https://github.com/emlog/emlog/security/advisories/GHSA-2g2w-vmg7-pq4q	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-21429`	vulnerable	2026-06-08 07:49:16.376991	Emlog has Broken Access Control (BAC) Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As of time of publication, no known patched versions are available. Published: 2026-01-02T17:23:17.252Z Updated: 2026-01-02T21:05:56.458Z Open on db.gcve.eu Reference links https://github.com/emlog/emlog/security/advisories/GHSA-jw5v-2g53-rx8w	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-62717`	vulnerable	2026-06-08 07:39:16.526454	Emlog Pro session verification code error due to clearing logic error Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df. Published: 2025-10-24T20:13:47.407Z Updated: 2025-10-24T20:34:16.932Z Open on db.gcve.eu Reference links https://github.com/emlog/emlog/security/advisories/GHSA-wwj4-ppfj-hcm6 https://github.com/emlog/emlog/commit/1f726df0ce56a1bc6e8225dd95389974173bd0c0	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.