Cross-Site Scripting in Emlog Pro by Emlog
CVE-2025-25825

7.1HIGH

Key Information:

Vendor

Emlog

Status
Emlog Pro
Vendor
CVE Published:
26 February 2025

What is CVE-2025-25825?

A cross-site scripting (XSS) vulnerability in Emlog Pro version 2.5.4 allows attackers to exploit the application by injecting malicious payloads through the Title field in the article category section. This could lead to the execution of arbitrary web scripts or HTML on users’ browsers, posing significant security risks for affected installations. It is crucial for users of this software to implement mitigative measures to safeguard their applications.

References

https://www.emlog.net/
http://emlogpro.com
https://github.com/Ka7arotto/emlog/blob/main/xss-4.md

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.