CVE-2025-47784

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause "strreplace" to replace the value of "nameorig" with empty, causing deserialization to fail and return "false". Commit...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

CVE-2025-47784

Emlog (open-source website building system) is affected by CVE-2025-47784 in versions 2.5.13 and earlier, due to a deserialization vulnerability. A crafted nickname can trigger str_replace to set name_orig to an empty value, causing deserialization to fail and return false. The issue is mitigated...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

emlog 跨站脚本漏洞

emlog is emlog open source a PHP and MySQL based CMS site building system. A cross-site scripting vulnerability exists in emlog version 2.5.13, which originates from the unvalidated perpagenum parameter in /admin/comment.php, and could lead to a stored cross-site scripting attack...

CVE-2025-47786: Improper Neutralization of Input During Web Page Generation

Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In /admin/comment.php, the parameter perpagenum is not validated and is directly...

emlog SQL注入漏洞

emlog is emlog open source PHP and MySQL based on a set of CMS website builder . emlog 2.5.9 and previous versions exist SQL injection vulnerability , the vulnerability stems from admin/articlesave.php in the $origContent parameter is not strictly filtered , which may lead to SQL injection and...

PT-2025-21365 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions up to and including 2.5.9 Description: The issue occurs due to a SQL injection vulnerability in the $origContent parameter in admin/article save.php, which is not strictly filtered. This allows registered users to access...

emlog 代码问题漏洞

emlog is emlog open source a set of PHP and MySQL based CMS site building system . A code issue vulnerability exists in versions prior to emlog 2.5.10, which stems from store.php not properly validating the contents of the ZIP plugin file, which could lead to the execution of arbitrary code...

PT-2025-21367 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro versions prior to 2.5.10 Description: The issue is related to a file upload vulnerability in the store.php component, which fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validatio...

emlog 代码问题漏洞

emlog is emlog open source a PHP and MySQL based CMS website builder. A code issue vulnerability exists in emlog 2.5.13 and earlier versions, which stems from a deserialization vulnerability that could lead to a deserialization failure...

PT-2025-21361

Name of the Vulnerable Software and Affected Versions: Emlog versions 2.5.13 and earlier Description: Emlog is an open source website building system. The system has a deserialization issue. A user can create a carefully crafted nickname, causing str replace to replace the value of name orig with...

CVE-2025-47785: Improper Neutralization of Special Elements used in an SQL Command

Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/articlesave.php is not strictly filtered. Since admin/articlesave.php can be accessed by ordinary registered users, this will cause SQL injectio...

CVE-2025-47787: Unrestricted Upload of File with Dangerous Type

Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation...

CVE-2025-47784: Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

PT-2025-21366 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog version 2.5.13 Description: Emlog is an open source website building system with a stored cross-site scripting issue. This allows any registered user to construct malicious JavaScript, inducing all website users to click. The...

CVE-2025-30372

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. searchcontroller.php does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potentia...

CVE-2025-30372

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. searchcontroller.php does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potentia...

CVE-2025-30372 Emlog Pro contains an SQL injection vulnerability.

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. searchcontroller.php does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potentia...