CVE-2025-53925

MEDIUM

emlog <= 2.5.17 - Authenticated Stored Cross-Site Scripting via SVG File Upload

Title source: llm

Description

Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload an .svg file that contains JavaScript code that is later executed. As of time of publication, no known patched versions exist.

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/emlog/emlog/security/advisories/GHSA-x4wj-rhvg-hqr9

Scores

CVSS v3 5.4

EPSS 0.0025

EPSS Percentile 16.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

emlog/emlog < 2.5.17

Published Jul 16, 2025

Tracked Since Feb 18, 2026