VULNERABILITY INTELLIGENCE

CVE-2025-61597

CVSS score7.6 HIGH
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-10-03
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Description

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references