CVE-2026-73847-emlog-PoC

CVE-2026-73847 — ИИ-ассистент emlog: CSRF → выполнение SQL → захват администратора PoC для отсутствующей CSRF-защиты в конечной точке executetool ИИ-ассистента emlog pro, которая позволяет атакующему использовать аутентифицированную сессию администратора для выполнения произвольного SQL по базе...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — отключённая проверка TLS-сертификатов в ИИ-ассистенте MITM из соседней сети → кража API-ключа LLM-провайдера & внедрение ИИ-ответов Сводка · Схема атаки · Затронутый код · Подтверждение · Устранение · Хронология · Ссылки 📋 Краткий обзор | ---|--- CVE ID| CVE-2026-67598...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745: Improper Neutralization of Input During Web Page Generation

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

The software EMLOG-Pro 2.6.29 is affected by a Cross-Site Scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts, which can be leveraged to upload a malicious shell to the system. While the vulnerability requires user interaction, it poses a significant risk to the...

PT-2026-96268

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

CVE-2026-88745

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell...

Exploit for CVE-2026-73847

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Adm...

Exploit for CVE-2026-67598

CVE-2026-67598 Emlog Pro — Disabled TLS Certificate Validation i...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598

CVE-2026-67598 affects Emlog Pro up to version 2.6.23. The TLS certificate verification is disabled in include/service/ai.php via CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST across sendStream(), sendImageRequest(), send(), and fetchSearchHtml(), with no option to re-enable verification. Thi...

EUVD-2026-52405

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-67598 Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

PT-2026-67487

Name of the Vulnerable Software and Affected Versions Emlog Pro versions prior to 2.6.24 Description In the file include/service/ai.php, TLS certificate validation is disabled, allowing network-adjacent attackers to intercept outbound HTTPS requests to configured Large Language Model LLM provider...

CVE-2026-67598: Improper Certificate Validation

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...

CVE-2026-39276

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or...