SB20260815109 - Cross-site scripting in Emlog Pro

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815109

SB20260815109 - Cross-site scripting in Emlog Pro

Published: August 15, 2026

Security Bulletin ID SB20260815109
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-73848)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in an administrator\'s browser.

The vulnerability exists due to cross-site scripting in the article editor tag rendering in admin/views/article_write.php when rendering tag names inside a javascript: href attribute. A remote user can create a crafted tag name and induce an administrator to click the poisoned tag to execute arbitrary JavaScript in an administrator\'s browser.

User interaction is required because an administrator must open the article editor, expand the tag list, and click the crafted tag.


Remediation

Install update from vendor's website.

References