Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-61930

Emlog is an open source website building system. Emlog Pro versions 2.5.19 and earlier are vulnerable to Cross‑Site Request Forgery (CSRF) on the password change endpoint. An attacker can trick a logged‑in administrator into submitting a crafted POST request to change the admin password without consent. Impact is account takeover of privileged users. Severity: High. As of time of publication, no known patched versions exist.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9119dbe164c48cadcecea4c97f956fe4fca6fef117b5a4d915cdd34be6462295
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"emlog","vendor":"emlog","versions":[{"status":"affected","version":"<= pro-2.5.19"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:dd124be4e9dab4be913699773414545e2508ac0150c0f371674c93403871e2a6 · sha256:597ed009f494cb30… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:dd124be4e9dab4be913699773414545e2508ac0150c0f371674c93403871e2a6 · sha256:597ed009f494cb30… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-352","description":"CWE-352: Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:dd124be4e9dab4be913699773414545e2508ac0150c0f371674c93403871e2a6 · sha256:597ed009f494cb30… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/emlog/emlog/security/advisories/GHSA-m2qw-9wjx-qxm2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:dd124be4e9dab4be913699773414545e2508ac0150c0f371674c93403871e2a6 · sha256:597ed009f494cb30… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer