EUVD-2026-52484
GHSA-vcrr-2866-jgp7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS requires a low-privilege account and active admin review (UI:R); scope change (S:C) reflects script execution in the admin's browser context; no availability impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.
AnalysisAI
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Technical ContextAI
Emlog is a PHP-based blogging and CMS platform. The vulnerability resides in the article publishing module (/admin/article.php), which fails to adequately sanitize user-supplied HTML/JavaScript content before storing it in the database and rendering it in the administrative backend. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) failure: untrusted input from a low-privilege user is persisted and later reflected into a privileged execution context without escaping. The CVSS scope change (S:C) correctly captures that the script executes outside the article-author's security context - inside the admin's authenticated browser session - enabling cross-context privilege escalation. CPE data provided is generic (cpe:2.3:a:n/a:n/a) and has not been formally assigned by NVD, reducing automated scanner precision for this product.
RemediationAI
No vendor-released patched version has been identified at time of analysis; the fix version was not specified in any available reference. The researcher's CVE report is available at https://github.com/LING12138-sg/MyCVE-Report and the upstream codebase at https://github.com/emlog/emlog - administrators should monitor these for a patched release and apply it as soon as one is published. As compensating controls: restrict article submission to fully trusted users only, removing public or semi-trusted contributor roles until a patch is available - this eliminates the PR:L attack surface entirely. Implement a Content Security Policy (CSP) header that blocks inline script execution in the admin backend, which would prevent injected JavaScript from running even if stored (trade-off: may break legitimate inline scripts in the admin UI and requires testing). Enable HttpOnly flags on session cookies to limit the impact of any XSS that does execute. Deploy a Web Application Firewall rule to detect and block common XSS payload patterns in article body submissions, noting this is bypassable by determined attackers.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today