CVE-2026-34229

MEDIUM

Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass

Title source: cna

Description

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.

References (2)

Scores

CVSS v3 6.1
EPSS 0.0003
EPSS Percentile 8.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
emlog/emlog < 2.6.8 (2 CPE variants)
Published Apr 03, 2026
Tracked Since Apr 04, 2026