These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-03T21:16:40.390Z and has not been modified since then. Emlog CMS version 2.6.14 or earlier contains a stored cross-site scripting (XSS) vulnerability in the article publishing module, allowing a remote authenticated attacker to inject arbitrary JavaScript code via article content. When an administra [truncated]
CVE-2026-46687 is a path-traversal vulnerability in Emlog 2.6.13 and earlier. The article publishing interface stores a path-traversal template parameter without validation. Later, log_controller.php checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. This vulnerability has a high CVSS score of 7 [truncated]
CVE-2026-46686 is a reflected cross-site scripting vulnerability in Emlog 2.6.13 and earlier. The vulnerability exists in the admin backend user search module's keyword parameter, which is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php. This allows an attacker to inject malicious JavaScript code, potentially leading to reflected cross- [truncated]
A path traversal vulnerability in Emlog Pro v2.6.9 allows authenticated administrators to execute arbitrary PHP code via malicious template uploads. The vulnerability stems from insufficient validation of ZIP archive contents, permitting directory traversal sequences in filenames to overwrite default template files or inject malicious code directly into the active template. This requires high privileges ( [truncated]
CVE-2026-34788 is a SQL injection vulnerability in Emlog, a popular open-source website building system. This vulnerability affects versions 2.6.2 and prior. The issue lies in the updateTagName() function located in include/model/tag_model.php at line 168. Here, user input is directly interpolated into the SQL query string without proper sanitization or parameterized queries. Specifically, the function fa [truncated]
CVE-2026-34787 is a Local File Inclusion (LFI) vulnerability in Emlog versions 2.6.2 and prior. The vulnerability exists in admin/plugin.php at line 80, where the $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. This allows an attacker to bypass CSRF token checks and include arbitrary PHP files from the server filesystem, leading to code execution [truncated]
CVE-2026-34607 is a path traversal vulnerability in Emlog, a website building system. The vulnerability exists in the emUnZip() function, which allows an authenticated admin to upload a crafted ZIP containing entries with ../ sequences, potentially leading to Remote Code Execution (RCE). This vulnerability has a high CVSS score of 7.2 and is considered High severity. Users of Emlog versions 2.6.2 and prio [truncated]
CVE-2026-34228 is a high-severity vulnerability in Emlog, a popular open-source website building system. This vulnerability allows attackers to execute remote SQL and write arbitrary files, potentially leading to complete control of the affected system. The vulnerability exists in the backend upgrade interface, which accepts remote SQL and ZIP URLs via GET parameters without validating a CSRF token. An at [truncated]