CVE-2026-42287 | Emlog is an open source website building system. Prior to ve… | CVSS 10.0 CRITICAL

Description

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

Metadata

CVE ID: CVE-2026-42287
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-26 12:13 UTC
Published: 2026-05-08 21:51 UTC
Last updated: 2026-05-11 18:04 UTC
Primary CWE: CWE-89
CWE-89: Improper Neutralization of Special Elements used in …
Vendor / Product: emlog / emlog
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
emlog	emlog	—	< 2.6.11

Weakness (CWE)

CWE	Source	Description
CWE-89	cna	CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (1)

https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw