Skip to main content

Emlog CVE-2026-31954

NONE
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-03-11 security-advisories@github.com
CSRF Emlog

Severity by source

GitHub Advisory
0.0 LOW
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:07 vuln.today
CVE Published
Mar 11, 2026 - 20:16 nvd
NONE

DescriptionGitHub Advisory

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Analysis

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Emlog

View all
CVE-2025-29401 CRITICAL POC
9.8 Mar 19

An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execut
CVE-2023-44974 CRITICAL POC
9.8 Oct 03

An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execut
CVE-2023-44973 CRITICAL POC
9.8 Oct 03

An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to exec
CVE-2023-43291 CRITICAL POC
9.8 Sep 27

Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code v
CVE-2021-40883 CRITICAL POC
9.8 Dec 14

A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. Rated critical severity (CVSS 9.8
CVE-2021-31737 CRITICAL POC
9.8 May 06

emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/
CVE-2019-16868 CRITICAL POC
9.8 Sep 25

emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request w
CVE-2025-61318 CRITICAL POC
9.1 Dec 08

Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php comp
CVE-2026-21430 CRITICAL POC
9.3 Jan 02

Emlog 2.5.23 is vulnerable to CSRF in article creation, which chains with stored XSS to achieve account takeover. An att
CVE-2026-22799 HIGH POC
8.8 Jan 12

Remote code execution in Emlog v2.6.1 and earlier allows authenticated attackers to upload arbitrary files through an in
CVE-2021-30081 HIGH POC
8.8 May 24

An issue was discovered in emlog 6.0.0stable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
CVE-2018-18316 HIGH POC
8.8 Oct 15

emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. Rated high severity (CVSS 8.8), this vulnerability is remot

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2026-31954 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy