CVE-2025-30372

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensitive information from the user database. Version pro-2.5.9 fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
emlogemlog>= pro-2.5.7, < pro-2.5.9

References

Timeline

Published
Mar 28, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-303735.3Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is preseCVE-2025-303757.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locaCVE-2025-303767.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303777.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-303787.0Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-303797.8Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30388.8A vulnerability was found in code-projects Payroll Management System 1.0 and classified as critical. This issue affects some unknown processCVE-2025-303817.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303827.8Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-303837.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locaCVE-2025-303847.0Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-303857.8Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2025-30372: Critical severity, CVSS 9.8 | Vulnix