CyberRota Analysis
AI-GeneratedEmlog versions 2.6.29 and earlier are vulnerable due to improper HTML encoding of tag names in the article editor, allowing attackers to inject and execute arbitrary JavaScript code. This vulnerability can lead to cross-site scripting (XSS) attacks, potentially compromising user data and site integrity. Organizations using affected versions of Emlog should prioritize remediation to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.