Cross-Site Request Forgery Vulnerability in Emlog Pro by Emlog

CVE-2025-61930

What is CVE-2025-61930?

Emlog, an open-source website-building platform, faces a significant security issue in Emlog Pro versions 2.5.19 and earlier. The vulnerability is a Cross-Site Request Forgery (CSRF) that targets the password change endpoint, allowing an attacker to trick a logged-in administrator into executing a crafted POST request. This malicious action could lead to unauthorized changes in the admin password, potentially resulting in account takeover of privileged users. As of the current advisories, there are no patched versions available to mitigate this risk.

References