SB20260815110 - Improper access control in Emlog Pro

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260815110

SB20260815110 - Improper access control in Emlog Pro

Published: August 15, 2026

Security Bulletin ID SB20260815110
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-73850)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to improper access control in the queryDatabase() function in admin/ai.php when handling execute_tool requests for the query_database tool. A remote privileged user can send a specially crafted POST request containing arbitrary SQL statements to execute arbitrary SQL commands.

The issue affects the admin functionality exposed through the ai.php endpoint.


Remediation

Install update from vendor's website.

References