Skip to main content

Emlog CVE-2021-40883

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2021-12-14 cve@mitre.org
RCE File Upload Emlog
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 14, 2021 - 19:15 nvd
CRITICAL 9.8

DescriptionNVD

A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.

AnalysisAI

A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. Affected products include: Emlog.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Emlog

View all
CVE-2025-29401 CRITICAL POC
9.8 Mar 19

An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execut
CVE-2023-44974 CRITICAL POC
9.8 Oct 03

An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execut
CVE-2023-44973 CRITICAL POC
9.8 Oct 03

An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to exec
CVE-2023-43291 CRITICAL POC
9.8 Sep 27

Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code v
CVE-2021-31737 CRITICAL POC
9.8 May 06

emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/
CVE-2019-16868 CRITICAL POC
9.8 Sep 25

emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request w
CVE-2025-61318 CRITICAL POC
9.1 Dec 08

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php comp
CVE-2026-21430 CRITICAL POC
9.3 Jan 02

Emlog 2.5.23 is vulnerable to CSRF in article creation, which chains with stored XSS to achieve account takeover. An att
CVE-2026-22799 HIGH POC
8.8 Jan 12

Remote code execution in Emlog v2.6.1 and earlier allows authenticated attackers to upload arbitrary files through an in
CVE-2021-30081 HIGH POC
8.8 May 24

An issue was discovered in emlog 6.0.0stable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
CVE-2018-18316 HIGH POC
8.8 Oct 15

emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2025-30372 HIGH POC
7.7 Mar 28

Emlog is an open source website building system. Rated high severity (CVSS 7.7), this vulnerability is remotely exploita

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2021-40883 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy