Emlog CVE-2026-34788

CVSS 6.5 reflects moderate risk with a network attack vector but high complexity requirement (PR:H means authenticated/privileged access mandatory). EPSS data is not provided in the input, but the authentication barrier (administrative privilege requirement) significantly reduces real-world exploitation probability compared to the base CVSS score suggests. No CISA KEV status is referenced, and no public exploit code is documented, indicating this is not an active widespread threat. However, the high-impact nature (C:H, I:H confidentiality and integrity impact) combined with the straightforward SQL injection pattern means any attacker who gains admin access could leverage this trivially. Organizations should prioritize this based on admin account security posture rather than treating it as imminent widespread risk. The lack of patch availability elevates concern for long-term exposure if administrative access is compromised.

An attacker with compromised or malicious administrator credentials accesses the Emlog admin panel and manipulates tag name input fields to inject SQL commands such as UNION-based SELECT queries to extract user credentials or email addresses from the database. Because the vulnerability requires high privileges (PR:H), exploitation requires prior compromise of an admin account or insider threat, but once achieved, the attacker can read sensitive data or modify database records without leaving obvious application-level audit trails. No public exploit code simplifies the attack, but standard SQL injection techniques apply.