CVE-2025-53923: Emlog vulnerable to reflected Cross-site Scripting in admin panel

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-16 · updated 2026-06-17
Weakness: CWE-79

Description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Due to lack of sanitization it is possible to inject HTML/JS code into keyword parameter. If one persuades an user into clicking into prepared link it is possible to execute any JS code in admin's browser. As of time of publication, no known patched versions exist.

Affected products

emlog: through 2.5.17

References

https://github.com/emlog/emlog/security/advisories/GHSA-vvx2-m94x-f54m
https://github.com/emlog/emlog/security/advisories/GHSA-vvx2-m94x-f54m

Get alerted when CVE-2025-53923 or the next vulnerability affects your stack