emlog has 5 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The busiest recent month was September 2026 with 4. The median CVSS is 6.9 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-53758High· 8.7Emlog is an open source website building system60CVE-2025-61318Critical· 9.1Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability50CVE-2026-53756Medium· 4.9Emlog is an open source website building system39CVE-2026-73848Medium· 6.9Emlog is an open source website building system38CVE-2026-53757Medium· 6.9Emlog is an open source website building system38
emlog vulnerabilities
CVEs affecting emlog, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-53758High· 8.7PoCEmlog is an open source website building system
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unes…
CVE-2026-73848Medium· 6.9Emlog is an open source website building system
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslas…
CVE-2026-53757Medium· 6.9Emlog is an open source website building system
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating entry paths for ../ traversal sequences. Only the first entry's…
CVE-2026-53756Medium· 4.9PoCEmlog is an open source website building system
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filt…
CVE-2025-61318Critical· 9.1Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for del…