What is the CVSS score of CVE-2026-34788?

CVE-2026-34788 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-34788

MEDIUM

SQL Injection (CWE-89)

2026-04-03 GitHub_M

SQLi PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:37 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.

AnalysisAI

SQL injection in Emlog tag management allows authenticated administrators to execute arbitrary SQL queries through the updateTagName() function in include/model/tag_model.php. Versions 2.6.2 and prior are affected. An attacker with administrative privileges can exploit this via direct SQL manipulation to modify or exfiltrate database contents. No public exploit code or active exploitation has been confirmed; patch status remains unavailable as of publication.

Technical ContextAI

Emlog is a PHP-based website building system that uses a custom database abstraction layer. The vulnerability exists in the tag_model.php file's updateTagName() function, which constructs SQL UPDATE queries by directly concatenating user-supplied input into the query string rather than using parameterized prepared statements or the framework's own escape_string() method. CWE-89 (SQL Injection) manifests when user input reaches SQL execution without neutralization. The vulnerability affects all versions of the Emlog package (CPE: cpe:2.3:a:emlog:emlog:*:*:*:*:*:*:*:*) up to and including 2.6.2, suggesting a systemic pattern in how this function was implemented.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation requires manual code remediation: replace the direct string concatenation in updateTagName() with either parameterized prepared statements using placeholders or the framework's escape_string() method on all user-supplied inputs before SQL construction. Organizations must apply this fix directly to include/model/tag_model.php at line 168 and conduct regression testing on tag update functionality. Additionally, restrict administrative access to minimum-necessary users and monitor admin activity logs for suspicious database queries. Monitor the GitHub security advisory (https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf) and Emlog's official repository for patch releases.