CVE-2026-53756 Details
Description
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.
A blind SQL injection vulnerability has been identified in Emlog CMS Pro versions prior to 2.6.16. The issue arises in the User_Model::getUserDataByLogin() method, where the $account parameter is directly inserted into SQL queries without any sanitization. This vulnerability can be exploited through the authentication cookie validation process, allowing an attacker to manipulate the cookie data and execute arbitrary SQL commands. Exploitation requires knowledge of the AUTH_KEY, which is accessible to users with administrative privileges.
Users are advised to update to Emlog CMS Pro version 2.6.16 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/emlog/emlog/commit/92b6eea618891b28ed0c520564dff26e170645b4 | [email protected] | Source CodeVendor |
| https://github.com/emlog/emlog/releases/tag/pro-2.6.16 | [email protected] | Release NotesVendor |
| https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Emlog | < 2.6.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |