Stored Cross-Site Scripting Vulnerability in Emlog Pro by Emlog
CVE-2025-60447

5.9MEDIUM

Key Information:

Vendor

Emlog

Status
Emlog Pro
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60447?

A stored Cross-Site Scripting (XSS) vulnerability in Emlog Pro version 2.5.19 allows attackers to inject malicious HTML code through the email template configuration settings. This flaw resides in the component located at /admin/setting.php?action=mail, where the inputted HTML code is not adequately sanitized. As a result, this vulnerability permits persistent JavaScript execution, posing risks for data exposure and security breaches in the application.

References

https://snowhy77.github.io/2025/08/21/Stored-XSS-Vulnerab...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.