CyberRota Analysis
AI-GeneratedEmlog versions 2.6.13 and earlier are vulnerable due to a reflected cross-site scripting flaw in the admin backend user search module, where the keyword parameter is inadequately sanitized before being rendered. This vulnerability could allow attackers to execute malicious scripts within an administrator's session, potentially compromising the integrity of the backend. Administrators using affected versions should prioritize addressing this issue to safeguard their systems against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.