CVE-2025-61597CWE-79cross-site-scripting

CVE-2025-61597

High · published October 3, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-03T11:15Z
Affected products (1)
ProductVersionsFixed in
emlog/emlog≤ 2.5.19—
References (2)
https://github.com/emlog/emlog/pull/179 · [email protected]https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m · [email protected]
EPSS history
Timeline
  • 03 OCT 06:16Z
    Emlog Pro is vulnerable to stored XSS attack through HTML template injection
    cvelistv5