What’s Vulnerable › Vulnerabilities

CVE-2025-64349: ELOG user profile missing authorization

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-31 · updated 2026-06-17
• Weakness: CWE-862

Description

ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.

Affected products

• ELOG: through 3.1.5-20251014

References

• https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946
• https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json
• https://www.cve.org/CVERecord?id=CVE-2025-64349

Get alerted when CVE-2025-64349 or the next vulnerability affects your stack