CVE-2025-47785
Published: 15 May 2025
Summary
CVE-2025-47785 is a high-severity SQL Injection (CWE-89) vulnerability in Emlog Emlog. Its CVSS base score is 8.3 (High).
Operationally, ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Emlog is an open source website building system affected by a SQL injection vulnerability in versions up to and including 2.5.9. The flaw stems from insufficient filtering of the $origContent parameter in admin/article_save.php and is tracked under CWE-89 with a CVSS score of 8.3.
Ordinary registered users can exploit the issue when the registered site feature is enabled. Successful injection yields the administrator account and password, which can then be used to perform remote code execution via the backend.
The referenced GitHub Security Advisories GHSA-939m-47f7-m559 do not indicate that a fix has been released, consistent with the statement that patch availability was unknown at publication time. The associated EPSS score has remained flat at 0.0157 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28127
Vulnerability details
Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this will cause…
more
SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.