CVE-2026-42287CWE-89

Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions

Critical · published May 8, 2026

CVSS v4.0
10.0
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-08T21:51Z
EPSS history
Timeline
  • 08 MAY 21:51Z
    Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
    cvelistv5