CVE-2025-25783: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...

emlog 安全漏洞

emlog is a PHP and MySQL based CMS website builder for emlog personal developers. A security vulnerability exists in emlog Pro version v2.5.4, which originates from the postStrVar function in articlesave.php and is vulnerable to cross-site scripting attacks...

PT-2025-8723

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the postStrVar function at the "article save.php" endpoint. Recommendations For...

CVE-2025-25825

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section...

CVE-2025-25818: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...

PT-2025-8708

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.3 Description The issue is related to an arbitrary file upload vulnerability in the admin/plugin.php component. This vulnerability allows attackers to execute arbitrary code by uploading a crafted Zip file. Recommendation...

CVE-2025-25825: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section...

PT-2025-8725

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Titile in the article category section. Recommendations For Emlog Pro versio...

PT-2025-8724

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the article header at the "/admin/article.php" API endpoint. Recommendations For...

CVE-2025-25783

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file...

CVE-2025-25818

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...

PT-2025-8726

Name of the Vulnerable Software and Affected Versions Emlog Pro version 2.5.4 Description A Server-Side Request Forgery SSRF issue in the sort.php component allows attackers to scan local and internal ports by supplying a crafted URL. Recommendations For Emlog Pro version 2.5.4, update to a newer...

CVE-2025-25827: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25827

A Server-Side Request Forgery SSRF in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL...

CVE-2025-25827

A Server-Side Request Forgery (SSRF) vulnerability exists in the sort.php component of Emlog Pro v2.5.4 . This flaw allows an attacker to scan local and internal ports by providing a crafted URL . While a proof-of-concept has been published, specific exploit links are not provided in the document...

CVE-2025-25783

Emlog Pro v2.5.3 is vulnerable to an arbitrary file upload vulnerability in the adminackup.php (also referenced as adminackup.php or adminplugin.php in related records) component. The root cause is a lack of validation for uploaded files, which allows an attacker to upload a crafted Zip file to...

CVE-2025-25823

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php...

Emlog Pro Cross-Site Scripting Vulnerability (CNVD-2025-01706)

Emlog Pro is a lightweight blogging system that provides easy-to-use blog management features. A cross-site scripting vulnerability exists in Emlog Pro 2.4.3. The vulnerability originates from unknown functionality in the file /admin/twitter.php of the Subpage Handler component. An attacker can...

CVE-2024-13140

A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...

CVE-2024-13140

A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3. Affected is an unknown function of the file /admin/article.php?action=uploadcover of the component Cover Upload Handler. The manipulation of the argument image leads to cross site scripting. It is possible to launc...