CVE-2026-48944: Improper Limitation of a Pathname to a Restricted Directory

The K2 frontend article-save handler accepts an attachmentNexisting POST field that is concatenated with JPATHSITE/ and passed to JFile::copy. JPath::clean does NOT strip .., and there is no allow-list of source paths. An Author can therefore copy configuration.php or any other file readable by t...

EUVD-2025-28127

Malicious code in bioql PyPI...

emlog SQL注入漏洞

emlog is emlog open source PHP and MySQL based on a set of CMS website builder . emlog 2.5.9 and previous versions exist SQL injection vulnerability , the vulnerability stems from admin/articlesave.php in the $origContent parameter is not strictly filtered , which may lead to SQL injection and...

CVE-2025-25818

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...

CVE-2025-25818

A cross-site scripting (XSS) vulnerability exists in Emlog Pro v2.5.4 , a PHP and MySQL based CMS website builder. The flaw originates from the postStrVar function at the article_save.php endpoint, where an attacker can inject a crafted payload to execute arbitrary web scripts or HTML. No specifi...

emlog 安全漏洞

emlog is a PHP and MySQL based CMS website builder for emlog personal developers. A security vulnerability exists in emlog Pro version v2.5.4, which originates from the postStrVar function in articlesave.php and is vulnerable to cross-site scripting attacks...

PT-2025-8723

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the postStrVar function at the "article save.php" endpoint. Recommendations For...

CVE-2022-4640 Mingsoft MCMS Article save cross site scripting

A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2022-3968

A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/articlesave.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is...

emlog 跨站脚本漏洞

emlog is a PHP and MySQL-based CMS builder for the individual developers of emlog. emlog has a security vulnerability that originates from an unknown function in admin/articlesave.php, which can be exploited by attackers to cause cross-site scripting XSS by manipulating the parameter tag...

PT-2022-24986 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: emlog affected versions not specified Description: A vulnerability has been found in emlog, classified as problematic, affecting an unknown functionality of the file admin/article save.php. The manipulation of the tag argument leads to...