EUVD-2026-71623Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
AUTH_KEY possession maps to PR:H; once held, HMAC forgery is trivial (AC:L); impact is read-only database enumeration (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL - guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.
AnalysisAI
Blind SQL injection in Emlog CMS Pro's User_Model::getUserDataByLogin() function allows a remote attacker who controls the application's AUTH_KEY to enumerate database contents via the authentication cookie validation path. The $account value read from the HMAC-signed cookie is interpolated directly into SQL with no sanitization; the HMAC guard, which requires AUTH_KEY to forge, is the sole access barrier before the vulnerable query executes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first obtain the application's AUTH_KEY secret, used to sign authentication cookies via HMAC; without this key, the cookie fails validation before the injection path is reached. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the constrained risk profile: network reachability and high confidentiality impact are genuine, but the PR:H designation captures the meaningful prerequisite of holding the AUTH_KEY application secret. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Emlog Pro version 2.6.16, which contains the fix confirmed in commit 92b6eea618891b28ed0c520564dff26e170645b4 and available at https://github.com/emlog/emlog/releases/tag/pro-2.6.16. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execut
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execut
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to exec
Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code v
A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins. Rated critical severity (CVSS 9.8
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/
emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request w
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php comp
Emlog 2.5.23 is vulnerable to CSRF in article creation, which chains with stored XSS to achieve account takeover. An att
Remote code execution in Emlog v2.6.1 and earlier allows authenticated attackers to upload arbitrary files through an in
An issue was discovered in emlog 6.0.0stable. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
emlog v6.0.0 has CSRF via the admin/user.php?action=new URI. Rated high severity (CVSS 8.8), this vulnerability is remot
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today