CVE-2025-61597

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/emlog/emlog/pull/179	Patch
https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Emlog es un sistema de creación de sitios web de código abierto. En las versiones 2.5.21 e inferiores, una inyección de plantilla HTML permite XSS almacenado a través de la configuración de la plantilla de correo. Una vez que se guarda una carga útil maliciosa, cualquier visita posterior a la página de configuración en un contexto de administrador autenticado ejecutará JavaScript controlado por el atacante, lo que permite el robo de sesión/token y la toma de control total de la cuenta de administrador. Este problema se solucionó en la versión 2.5.22.

Information

Published : 2025-10-03 07:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-61597

Mitre link : CVE-2025-61597

CVE.ORG link : CVE-2025-61597

JSON object : View

Products Affected

emlog

emlog

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-61597", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61597", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T13:32:33.142242Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "emlog", "product": "emlog", "versions": [{"status": "affected", "version": "< 2.5.22"}]}]}], "published": "2025-10-03T07:15:45.667", "references": [{"url": "https://github.com/emlog/emlog/pull/179", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/emlog/emlog/security/advisories/GHSA-hj97-hp2c-6m4m", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross\u2011site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker\u2011controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22."}, {"lang": "es", "value": "Emlog es un sistema de creaci\u00f3n de sitios web de c\u00f3digo abierto. En las versiones 2.5.21 e inferiores, una inyecci\u00f3n de plantilla HTML permite XSS almacenado a trav\u00e9s de la configuraci\u00f3n de la plantilla de correo. Una vez que se guarda una carga \u00fatil maliciosa, cualquier visita posterior a la p\u00e1gina de configuraci\u00f3n en un contexto de administrador autenticado ejecutar\u00e1 JavaScript controlado por el atacante, lo que permite el robo de sesi\u00f3n/token y la toma de control total de la cuenta de administrador. Este problema se solucion\u00f3 en la versi\u00f3n 2.5.22."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "72E4E5DE-A4A2-4326-B8EE-71690D75F7AE", "versionEndIncluding": "2.5.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}