CVE-2025-47784 MEDIUM

CVE-2025-47784: Emlog vulnerable to Deserialization of Untrusted Data

Vendor Emlog
Product emlog
Weakness CWE-502 · Unsafe deserialization
Published May 15, 2025
Last update May 16, 2025
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.

Key dates

02Disclosure timeline

May 15, 2025 CVE published
May 16, 2025 Record updated