CVE-2026-53756

Name of the Vulnerable Software and Affected Versions Emlog CMS Pro versions prior to 2.6.16

Description Blind SQL injection occurs in the getUserDataByLogin() function of the User Model. The $account parameter is interpolated into SQL queries without filtering. This is reachable via the auth cookie validation path, where the $username variable is extracted from the cookie and passed to the database. Access to this path is protected by an HMAC signature, which requires the AUTH KEY to forge. Blind SQL injection is a technique that allows an attacker to infer data from a database by observing the application's response to specific queries.

Recommendations Update to version 2.6.16.