These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A SQL injection vulnerability exists in Emlog versions 2.6.20 and earlier, in the queryDatabase function in ai.php. This issue has been publicly disclosed and may impact users of the affected software. The vulnerability allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. Defenders should assess their exposure and prioritize patching or mitigating [truncated]
CVE-2026-73849 is a critical vulnerability in Emlog, an open-source website building system. The vulnerability exists in versions 2.6.26 and earlier, where the install.php file accepts an action=reinstall parameter without authentication, allowing a remote attacker to overwrite configuration files with attacker-controlled database settings and create a new administrator account.
CVE-2026-73847 debrief: Emlog AI Assistant CSRF vulnerability allows database access. The Emlog AI Assistant feature in versions 2.6.26 and earlier has a CSRF vulnerability, enabling remote unauthenticated attackers to submit forged requests to recently logged-in administrators. This can lead to reading and writing database tables, except for the blog table, and potentially allows an attacker to take over [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T21:16:40.390Z and has not been modified since then. Emlog CMS version 2.6.14 or earlier contains a stored cross-site scripting (XSS) vulnerability in the article publishing module, allowing a remote authenticated attacker to inject arbitrary JavaScript code via article content. When an administra [truncated]
CVE-2026-67598 is a critical vulnerability in Emlog Pro through version 2.6.23, where TLS certificate validation is disabled, allowing network-adjacent attackers to intercept HTTPS requests to LLM providers, extract Authorization Bearer API keys, and inject crafted AI responses. This vulnerability affects the sendStream(), sendImageRequest(), send(), and fetchSearchHtml() functions in include/service/ai.p [truncated]
CVE-2026-46687 is a path-traversal vulnerability in Emlog 2.6.13 and earlier. The article publishing interface stores a path-traversal template parameter without validation. Later, log_controller.php checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. This vulnerability has a high CVSS score of 7 [truncated]
CVE-2026-46686 is a reflected cross-site scripting vulnerability in Emlog 2.6.13 and earlier. The vulnerability exists in the admin backend user search module's keyword parameter, which is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php. This allows an attacker to inject malicious JavaScript code, potentially leading to reflected cross- [truncated]
A path traversal vulnerability in Emlog Pro v2.6.9 allows authenticated administrators to execute arbitrary PHP code via malicious template uploads. The vulnerability stems from insufficient validation of ZIP archive contents, permitting directory traversal sequences in filenames to overwrite default template files or inject malicious code directly into the active template. This requires high privileges ( [truncated]
CVE-2026-34788 is a SQL injection vulnerability in Emlog, a popular open-source website building system. This vulnerability affects versions 2.6.2 and prior. The issue lies in the updateTagName() function located in include/model/tag_model.php at line 168. Here, user input is directly interpolated into the SQL query string without proper sanitization or parameterized queries. Specifically, the function fa [truncated]
CVE-2026-34787 is a Local File Inclusion (LFI) vulnerability in Emlog versions 2.6.2 and prior. The vulnerability exists in admin/plugin.php at line 80, where the $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. This allows an attacker to bypass CSRF token checks and include arbitrary PHP files from the server filesystem, leading to code execution [truncated]
CVE-2026-34607 is a path traversal vulnerability in Emlog, a website building system. The vulnerability exists in the emUnZip() function, which allows an authenticated admin to upload a crafted ZIP containing entries with ../ sequences, potentially leading to Remote Code Execution (RCE). This vulnerability has a high CVSS score of 7.2 and is considered High severity. Users of Emlog versions 2.6.2 and prio [truncated]
CVE-2026-34228 is a high-severity vulnerability in Emlog, a popular open-source website building system. This vulnerability allows attackers to execute remote SQL and write arbitrary files, potentially leading to complete control of the affected system. The vulnerability exists in the backend upgrade interface, which accepts remote SQL and ZIP URLs via GET parameters without validating a CSRF token. An at [truncated]