CVE-2025-61599

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code. The malicious script is stored on the server and gets executed in the browser of any user, including administrators, when they click on the malicious post to view it. This issue does not currently have a fix.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 3, 2025
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-61609.8A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affectCVE-2025-616007.5Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerability in the IMAP protCVE-2025-616017.5BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticaCVE-2025-616027.5BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticaCVE-2025-616039.8WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified inCVE-2025-616047.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilitCVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilitCVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616097.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-61619.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown funct