CVE-2026-73850CWE-89sql-injection

CVE-2026-73850

published August 14, 2026

CVSS

8.6

EPSS

Percentile

29.6

In the wild

Unconfirmed

What it is

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: 8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00369 · 29.6th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-14T22:19Z

References (2)

https://github.com/emlog/emlog/security/advisories/GHSA-jffg-rpvp-2qx7 · [email protected]https://github.com/emlog/emlog/security/advisories/GHSA-jffg-rpvp-2qx7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

14 AUG 17:46Z
Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
cvelistv5