CVE-2026-42287

10.0 criticalEPSS 0.2%

Critical (10.0). EPSS 0.2% chance of exploitation in the next 30 days.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or system destruction. This issue has been patched in version 2.6.11.

Severity

CVSS 4.0

10.0 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-05-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw
https://github.com/emlog/emlog/security/advisories/GHSA-xxj8-fc63-j3gw

Check your stack JSON