CVE-2026-46686highCWE-79

CVE-2026-46686: high-severity vulnerability in emlog

Emlog Reflected Cross-Site Scripting

Published

Follow this CVE+ Monitor emlog

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.4%
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
emlog · emlog
Related CVEs — emlog

In the same product, most dangerous first.

CVE-2026-34607HIGHEmlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCEEPSS 0.9%CVE-2025-47785HIGHEMLOG SQL Injection VulnerabilityEPSS 0.8%CVE-2025-47787HIGHEmlog Pro Contains a File Upload VulnerabilityEPSS 0.8%CVE-2026-22799CRITICALemlog Arbitrary File Upload VulnerabilityEPSS 0.7%CVE-2026-73849CRITICALemlog allows unauthenticated reinstallation via `install.php?action=reinstall`.EPSS 0.7%CVE-2025-30372HIGHEmlog Pro contains an SQL injection vulnerability.EPSS 0.6%