CyberRota Analysis
AI-GeneratedEmlog versions 2.6.29 and earlier are vulnerable to stored cross-site scripting (XSS) due to the processing of article content with Parsedown without safe mode enabled, allowing raw HTML, including <script> tags, to be rendered unescaped. This vulnerability can lead to malicious scripts being executed in the browsers of all site visitors, posing a significant security risk. Organizations using affected versions should prioritize remediation, as there are currently no known patches available.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.