Emlog EUVD-2025-33213

Exploitation requires: (1) an authenticated account (PR:L) with the ability to save the mail/SMTP template settings on the Emlog admin backend (admin/views/setting_mail.php); (2) the injected payload persists, then (3) an administrator must subsequently load the mail settings page (UI:R) for the stored script to execute in their authenticated session. Limiting factors: it is not remote-unauthenticated - a valid login with access to the mail settings feature is needed, the victim admin must actively visit the vulnerable settings view, and it is confined to Emlog versions ≤2.5.21 (fixed in 2.5.22). No special non-default server configuration is required beyond the mail settings feature being used.

This is a moderate-severity stored XSS (CVSS 5.4, CWE-79) whose signals consistently point to LOW real-world urgency rather than a top priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N shows network reach and low complexity, but two meaningful brakes: PR:L (attacker must already be authenticated) and UI:R (an admin must subsequently visit the mail settings page for the payload to fire). EPSS is 0.03% (9th percentile), i.e. negligible modeled probability of widespread exploitation, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A public exploit does exist (GitHub Security Advisory GHSA-hj97-hp2c-6m4m), which raises feasibility but - per precision rules - POC availability is distinct from active exploitation. Signals are mutually consistent (low EPSS, no KEV, authenticated + user-interaction requirements), with no contradictions to flag. The one nuance worth verifying with the vendor: PR:L implies a lower-privileged authenticated account can plant the payload, yet mail/SMTP template settings are typically admin-only in Emlog; if only admins can reach that setting, the self-XSS angle reduces impact further and the practical threat is an admin-on-admin or CSRF-chained scenario. Net: real but low priority - patch in normal cycle, prioritize only if untrusted low-privilege accounts exist.

An authenticated user with access to the mail template/SMTP settings saves a crafted HTML payload containing JavaScript; because input is stored and rendered unsanitized on the settings page, the script executes the next time an administrator opens that page. A public exploit exists (GHSA-hj97-hp2c-6m4m), and given AV:N/AC:L the attack is technically simple, but it depends on an admin actually revisiting the mail settings view (UI:R).