PT-2025-40911

CVE-2025-61769

Published

2025-10-06

Updated

2025-10-09

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Emlog versions up to and including 2.5.22

Description A cross-site scripting (XSS) issue exists in Emlog, potentially allowing authenticated remote attackers to inject arbitrary web script or HTML. This is possible through the file upload functionality, specifically by uploading malicious .svg files containing JavaScript code which is then executed. The issue is addressed by commit 052f9c4226b2c0014bcd857fec47677340b185b1.

Recommendations Update to a version later than 2.5.22.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2025-61769