CVE-2026-52520

Name of the Vulnerable Software and Affected Versions Emlog CMS versions prior to 2.6.15

Description A stored cross-site scripting (XSS) issue exists in the article publishing module at the '/admin/article.php' endpoint. A remote authenticated attacker can inject arbitrary JavaScript code through the article content. This script executes in the browser session of an administrator who reviews or previews the submitted article, potentially enabling the attacker to perform administrative actions, such as creating a backdoor administrator account.

Recommendations Update Emlog CMS to version 2.6.15 or later.