CVE-2025-64348

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-643498.8ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a passw CVE-2025-64358.1If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with th CVE-2025-643503.8Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control CVE-2025-643514.3Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sen CVE-2025-643522.7Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Inco CVE-2025-643538.8Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a th CVE-2025-643546.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matias Ventura Gutenberg gutenberg all CVE-2025-643556.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor j CVE-2025-643564.3Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Acce CVE-2025-643574.3Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request CVE-2025-643584.3Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectl CVE-2025-643597.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Cons