CVE-2026-53756 Emlog Blind SQL Injection via Authentication Cookie

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

PT-2026-86177

CVE-2026-73848: XSS in emlog ≤2.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag—full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://t.co/utDcwWYnT1 cybersecurit valtersit CVE CVEAlert infose...

Exploit for CVE-2026-73847

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Adm...

CVE-2026-73850

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73847

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-73850

CVE-2026-73850 affects Emlog (open source website building system). The vulnerability is a SQL injection in the function queryDatabase() inside ai.php for version 2.6.20 and earlier. The described impact is arbitrary SQL execution, enabling an attacker with network access and high privileges (per...

CVE-2026-73850

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-73849

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849 emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd,...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...

CVE-2026-73847

CVE-2026-73847 affects emlog (pro) up to 2.6.23. The AI Assistant endpoint admin/ai.php?action=execute_tool lacks CSRF protection, relies on a session cookie without SameSite, and uses a hardcoded public confirm gate. This enables a forged cross-site request from an admin in-session to execute SQ...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

EUVD-2026-58740

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

PT-2026-72073

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...