EUVD-2026-58740Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H reflects Chrome-specific Lax+POST timing dependency and required recent admin login; PR:N for unauthenticated attacker; UI:R for mandatory admin page visit; C:H/I:H for full DB read and user-table write enabling account takeover; A:N as no availability impact is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.
AnalysisAI
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target site must run Emlog 2.6.26 or earlier with the AI Assistant feature accessible in the admin panel; (2) an administrator must have logged in recently - specifically within the Lax+POST grace window that Chrome applies to session cookies lacking a SameSite attribute, meaning exploitation is time-bounded to the period immediately following admin authentication; (3) the administrator must actively visit an attacker-controlled web page (UI:R) during that window, typically achieved via phishing or malicious link; (4) the administrator's browser must be Chrome or another browser implementing the Lax+POST temporary behavior. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N accurately captures the conditional but consequential nature of this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HTML page containing a hidden auto-submitting form that POSTs to the victim Emlog site's admin/ai.php with the execute_tool action, a query_database SQL payload reading SELECT username, pwd_hash FROM emlog_user, and the publicly-known confirmation string. The attacker delivers the link via phishing email to an Emlog administrator; if the administrator clicks within Chrome's Lax+POST grace window after their last login, the browser forwards the session cookie with the cross-site request, the SQL executes, and credential hashes are exfiltrated to the attacker. … |
| Remediation | No vendor-released patch has been identified at time of analysis; monitor the GitHub Advisory GHSA-v6wr-4x55-7qp5 at https://github.com/emlog/emlog/security/advisories/GHSA-v6wr-4x55-7qp5 for any fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today