CVE-2025-61930CWE-352csrf

CVE-2025-61930

High · published October 11, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-10-11T00:15Z
Affected products (1)
ProductVersionsFixed in
emlog/emlog≤ 2.5.19—
References (1)
https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2 · [email protected]
EPSS history
Timeline
  • 10 OCT 20:01Z
    Emlog Pro has CSRF issue that Enables Admin Password Reset
    cvelistv5