Filtered by vendor Emlog Pro Project Subscriptions
Filtered by product Emlog Pro Subscriptions

Search

Switch to Advanced Search (Beta)
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9173 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2026-01-08 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The file upload in include/service/media.php verifies the file extension based on a list defined in include/lib/option.php. This whitelist prevents unrestricted uploads (e.g. PHP files). Therefore, the attack possibility is just of theoretical nature.
CVE-2025-61318 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-12-09 5.3 Medium
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
CVE-2025-60447 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-10-15 5.9 Medium
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution.
CVE-2025-60448 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-10-08 6.1 Medium
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
CVE-2025-9296 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-09-12 4.7 Medium
A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-46540 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-06-17 6.3 Medium
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining system privileges.
CVE-2021-40610 1 Emlog Pro Project 1 Emlog Pro 2024-11-21 5.4 Medium
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.