CVE-2026-21431

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability in the `Resource media library ` function while publishing an article. As of time of publication, no known patched versions are available.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 2, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-214325.4Emlog is an open source website building system. Version 2.5.23 has a stored cross-site scripting vulnerability that can lead to account takCVE-2026-214337.7Emlog is an open source website building system. Versions up to and including 2.5.19 are vulnerable to server-side Out-of-Band (OOB) requestCVE-2026-214347.5webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption iCVE-2026-214357.5webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtranspoCVE-2026-214365.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could escape the directory set by `CVE-2026-214375.5eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not trCVE-2026-214385.3webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeaCVE-2026-214395.3badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker maCVE-2026-21448.1The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This CVE-2026-214409.2AdonisJS is a TypeScript-first web framework. A Path Traversal vulnerability in AdonisJS multipart file handling may allow a remote attackerCVE-2026-214417.5urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readCVE-2026-214436.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()`
CVE-2026-21431: Medium severity, CVSS 5.4 | Vulnix