CVE-20XX-?

Emlog CVEs.

Published CVEs affecting Emlog, ranked by exploit odds.

6 CVEs · updated 2026-11-06 08:59 UTC

Reset all
  1. CVE-2025-44139

    Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip

    Code execution Web app Emlog

    7.2 HIGH 0.8% exploit odds No fix listed
  2. CVE-2025-47787

    Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue.

    Code execution Web app Emlog

    8.9 HIGH 0.8% exploit odds Fix listed
  3. CVE-2026-22799

    Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access to enable the REST API setting, or via information disclosure vulnerabilities in the application. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

    Code execution Web app Emlog

    9.3 CRITICAL 0.7% exploit odds Fix listed
  4. CVE-2025-25783

    An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.

    Code execution Web app Emlog

    9.8 CRITICAL 0.7% exploit odds No fix listed
  5. CVE-2025-47784

    Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.

    Code execution Web app Emlog

    6.6 MEDIUM 0.5% exploit odds Fix listed
  6. CVE-2025-29405

    An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via uploading a crafted PHP file.

    Code execution Web app Emlog

    6.3 MEDIUM 0.4% exploit odds No fix listed

All CVEs affecting Emlog that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.