Emlog Pro CVE-2025-62717

Exploitation targets the email verification code path handled by checkMailCode() in include/service/user.php: because the fix shows the code erroneously cleared $_SESSION['code'] instead of $_SESSION['mail_code'], a valid mail code persists in the session after first use and can be replayed anywhere an email verification code is required. The practical prerequisite is that a valid verification code has already been issued/validated into the attacker-controlled session, so impact is confined to abusing that verification step; it does not by itself yield authentication bypass to an arbitrary account. Limiting factors: only affects Emlog Pro 2.5.23, only the email-verification-gated features are at risk, and the fixed commit removes the reuse window.

This is a genuinely low-priority issue despite being an authentication-related flaw. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores only 2.7 because the sole impact is VI:L (minor integrity) - a clearing-logic bug lets an email verification code be reused rather than being invalidated after use. There is no confidentiality (VC:N) or availability (VA:N) impact and no scope change. EPSS is low at 0.40% (33rd percentile), there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals point the same direction: no active or imminent widespread exploitation. The one caveat is that PR:N assumes an attacker can reach a state where a valid verification code exists in the session; real exploitation depends on the specific email-verification workflow being abused (e.g. reusing a code to bypass a one-time check), which bounds practical impact to that feature. Signals are consistent - low severity, low EPSS, no KEV, no POC - so this should be patched during normal maintenance, not as an emergency.

An attacker interacting with an Emlog Pro 2.5.23 workflow that uses email verification codes submits a code that was previously validated; because the session value is never cleared, the same code is accepted again for a later email-verification-gated action. No public exploit code exists, and the impact is limited to reusing a verification step rather than full account takeover.