CVE-2025-25818

MediumCVSS 5.1

Published: 26/02/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to inject malicious JavaScript or HTML via the postStrVar function in article_save.php.

Risk Assessment

Attackers can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.

Recommendation

Immediately update Emlog Pro to the latest patched version and implement input sanitization in the postStrVar function.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.