| Package | Affected versions | Patched versions |
|---|---|---|
| emlog | ≤ 2.5.19 |
Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will execute attacker‑controlled JavaScript, enabling session/token theft and full admin account takeover. This issue is fixed in version 2.5.22.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free