Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a clearing logic error. This means the verification code could be reused anywhere an email verification code is required. This issue has been fixed in commit 1f726df.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/emlog/emlog/commit/1f726df0ce56a1bc6e8225dd95389974173bd0c0 Patch
- https://github.com/emlog/emlog/security/advisories/GHSA-wwj4-ppfj-hcm6 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 2.7 · emlogNVD modified 2026-10-19 16:10
Affected (CPE criteria) 1
cpe:2.3:a:emlog:emlog:2.5.23:*:*:*:pro:*:*:*