Stored Cross-Site Scripting Vulnerability in EMLOG Pro
CVE-2025-61599

5.1MEDIUM

Key Information:

Vendor

Emlog

Status
Emlog
Vendor
CVE Published:
3 October 2025

What is CVE-2025-61599?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Twitter feature of EMLOG Pro versions 2.5.21 and lower. This flaw allows an authenticated user with permission to post Twitter messages to inject arbitrary JavaScript code, which is then stored on the server. When other users, including administrators, view the malicious post, the injected script is executed in their browsers, potentially compromising their accounts and data. Currently, there is no fix available for this vulnerability.

Affected Version(s)

emlog <= 2.5.21

References

https://github.com/emlog/emlog/security/advisories/GHSA-r...
x_refsource_CONFIRM

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-61599 : Stored Cross-Site Scripting Vulnerability in EMLOG Pro