CVE-2025-61930

Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Emlog es un sistema de creación de sitios web de código abierto. Emlog Pro versiones 2.5.19 y anteriores son vulnerables a Cross?Site Request Forgery (CSRF) en el endpoint de cambio de contraseña. Un atacante puede engañar a un administrador que ha iniciado sesión para que envíe una solicitud POST manipulada para cambiar la contraseña del administrador sin consentimiento. El impacto es la toma de control de cuentas de usuarios privilegiados. Severidad: Alta. Hasta el momento de la publicación, no existen versiones parcheadas conocidas.

Information

Published : 2025-10-10 20:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-61930

Mitre link : CVE-2025-61930

CVE.ORG link : CVE-2025-61930

JSON object : View

Products Affected

emlog

emlog

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-61930", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61930", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T20:44:39.648845Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "emlog", "product": "emlog", "versions": [{"status": "affected", "version": "<= pro-2.5.19"}]}]}], "published": "2025-10-10T20:15:38.803", "references": [{"url": "https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross\u2011Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged\u2011in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist."}, {"lang": "es", "value": "Emlog es un sistema de creaci\u00f3n de sitios web de c\u00f3digo abierto. Emlog Pro versiones 2.5.19 y anteriores son vulnerables a Cross?Site Request Forgery (CSRF) en el endpoint de cambio de contrase\u00f1a. Un atacante puede enga\u00f1ar a un administrador que ha iniciado sesi\u00f3n para que env\u00ede una solicitud POST manipulada para cambiar la contrase\u00f1a del administrador sin consentimiento. El impacto es la toma de control de cuentas de usuarios privilegiados. Severidad: Alta. Hasta el momento de la publicaci\u00f3n, no existen versiones parcheadas conocidas."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "72E4E5DE-A4A2-4326-B8EE-71690D75F7AE", "versionEndIncluding": "2.5.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}