CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation in the AI Assistant Network-adjacent MITM → LLM-provider API-key theft & AI-response injection Summary · Attack Flow · Affected Code · Proof · Remediation · Timeline · References 📋 At a glance | ---|--- CVE ID| CVE-2026-67598 Product|...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

The software EMLOG-Pro 2.6.29 is affected by a Cross-Site Scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts, which can be leveraged to upload a malicious shell to the system. While the vulnerability requires user interaction, it poses a significant risk to the...

CVE-2026-88745: Improper Neutralization of Input During Web Page Generation

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

PT-2026-96268

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

Exploit for CVE-2026-73847

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Adm...

Exploit for CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation i...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598

CVE-2026-67598 affects Emlog Pro up to version 2.6.23. The TLS certificate verification is disabled in include/service/ai.php via CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST across sendStream(), sendImageRequest(), send(), and fetchSearchHtml(), with no option to re-enable verification. Thi...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

EUVD-2026-52405

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

PT-2026-67487

Name of the Vulnerable Software and Affected Versions Emlog Pro versions prior to 2.6.24 Description In the file include/service/ai.php, TLS certificate validation is disabled, allowing network-adjacent attackers to intercept outbound HTTPS requests to configured Large Language Model LLM provider...

CVE-2026-67598: Improper Certificate Validation

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...