CVE-2025-61599CWE-79cross-site-scripting

CVE-2025-61599

Medium · published October 3, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-03T11:15Z
Affected products (1)
ProductVersionsFixed in
emlog/emlog≤ 2.5.21—
References (1)
https://github.com/emlog/emlog/security/advisories/GHSA-rm5c-mjpg-vm89 · [email protected]
EPSS history
Timeline
  • 03 OCT 06:27Z
    Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input
    cvelistv5