CVE-2026-53756

Published: Sep 4, 2026Modified: Sep 8, 2026Deferred

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (4)

https://github.com/emlog/emlog/commit/92b6eea618891b28ed0c520564dff26e170645b4

Source: security-advisories@github.com

https://github.com/emlog/emlog/releases/tag/pro-2.6.16

Source: security-advisories@github.com

https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg

Source: security-advisories@github.com

https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.