Emlog CVE-2026-46686

Exploitation requires (1) a victim who is an authenticated Emlog administrator with an active backend session, and (2) that victim to actively open an attacker-crafted link targeting the keyword parameter of admin/user.php (UI:A/required in the CVSS vector) - the attacker themselves needs no account (PR:N). Limiting factors: the payload only carries impact within an admin's browser context, so a non-admin or logged-out victim yields nothing; exploitation is defeated if the admin panel is network-restricted so the crafted request cannot reach an authenticated session, or if a restrictive Content-Security-Policy blocks injected script. Affected deployments are Emlog 2.6.13 and earlier.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N) scores 8.5, treating browser-side compromise of admin functionality as high confidentiality/integrity impact; however this is a reflected XSS that hinges on social-engineering an administrator into clicking a crafted URL (UI:A/required), which materially lowers real-world exploitability versus a no-interaction flaw. There is no EPSS score, no CISA KEV listing, and no public PoC in the provided data, so this is not confirmed active exploitation and should be treated as plausible but not urgently weaponized. The PR:N rating is technically consistent for reflected XSS (the attacker needs no account; the victim supplies the privilege), but exploitation only yields value if the clicked victim is a logged-in admin, so realistic impact is gated on targeting an authenticated operator. Net: a legitimate medium-to-high priority for Emlog operators due to admin-context impact and the absence of a patch, but not a mass-exploitation, drop-everything event on current signals.

An attacker crafts a URL to the target Emlog site's admin/user.php with a malicious payload in the keyword search parameter and, via phishing or a planted link, gets a logged-in administrator to open it. The reflected payload breaks out of the value attribute and executes JavaScript in the admin's authenticated session, letting the attacker steal the session/CSRF token or issue backend actions (e.g., create an admin account, modify content) as that administrator. No public PoC is identified, but the injection point and mechanism are described in the vendor advisory.