Profile Modification Vulnerability in ELOG by RITT

CVE-2025-64349

What is CVE-2025-64349?

The ELOG application allows authenticated users the ability to modify other users' profiles, presenting a significant security risk. An attacker can change a target user's email address and subsequently request a password reset, potentially gaining control over the target account. This issue is exacerbated by the default configuration of ELOG, which does not permit self-registration, thus limiting oversight on account creations and modifications. Organizations using ELOG should evaluate their security measures and apply patches as they become available to mitigate this risk.

References