CVE-2026-42287: Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-08 · updated 2026-06-17
Weakness: CWE-89

Description

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

Affected products

emlog: before 2.6.11

References

https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw
https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw

Get alerted when CVE-2026-42287 or the next vulnerability affects your stack