by Kastro
Paper/Archive/CVE-2026-42287

CVE-2026-42287

emlog emlog — Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions

EPSS 0.2%public exploitCVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 16.3.163 × 203.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

Affected

ProductAffectedFixed inSource
emlog< 2.6.11–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw