Cross-Site Scripting Vulnerability in Emlog Pro by Emlog
CVE-2025-25823

7.3HIGH

Key Information:

Vendor

Emlog

Status
Emlog Pro
Vendor
CVE Published:
26 February 2025

What is CVE-2025-25823?

A cross-site scripting (XSS) vulnerability exists in Emlog Pro v2.5.4, enabling attackers to execute arbitrary web scripts or HTML by injecting a malicious payload into the article header within the /admin/article.php endpoint. This exploitation could lead to unauthorized access, data theft, or defacement of the website.

References

https://www.emlog.net/
http://emlogpro.com
https://github.com/Ka7arotto/emlog/blob/main/xss-3.md

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.