Blind SQL Injection Vulnerability in Emlog CMS Pro by Emlog

CVE-2026-53756

What is CVE-2026-53756?

Emlog CMS Pro, an open source website building system, is vulnerable to a blind SQL injection. This occurs in the method User_Model::getUserDataByLogin() where the input parameter $account is inserted directly into SQL queries without sufficient validation or filtering. An attacker can exploit this weakness via the authentication cookie validation process. The vulnerability arises when $username extracted from the cookie is passed into SQL queries in an unfiltered manner, relying solely on an HMAC signature for security, which can potentially be forged. This security issue has been addressed in version 2.6.16 of Emlog CMS Pro.

References