CVE-2026-34229

MediumCVSS 6.1

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Emlog prior to version 2.6.8 has a stored XSS vulnerability in the comment module via URI scheme validation bypass. Attackers can inject malicious scripts that execute when the comment page is viewed.

Risk Assessment

Attackers can steal sessions of administrators or users, leading to account takeover and content modification.

Recommendation

Update Emlog to version 2.6.8 or later, which includes a fix for URI validation in the comment module.

Original NVD description (English source)

Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.