CVE-2025-9296 - Emlog Pro blogger.php unrestricted upload

Back Back to CVE browser

MEDIUM

Emlog Pro blogger.php unrestricted upload

Published Aug 21, 2025

5.1

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product Emlog Pro Default
n/a
- Version
  2.5.0
  Status
  affected
  Constraints
  -
- Version
  2.5.1
  Status
  affected
  Constraints
  -
- Version
  2.5.10
  Status
  affected
  Constraints
  -
- Version
  2.5.11
  Status
  affected
  Constraints
  -
- Version
  2.5.12
  Status
  affected
  Constraints
  -
- Version
  2.5.13
  Status
  affected
  Constraints
  -
- Version
  2.5.14
  Status
  affected
  Constraints
  -
- Version
  2.5.15
  Status
  affected
  Constraints
  -
- Version
  2.5.16
  Status
  affected
  Constraints
  -
- Version
  2.5.17
  Status
  affected
  Constraints
  -
- Version
  2.5.18
  Status
  affected
  Constraints
  -
- Version
  2.5.2
  Status
  affected
  Constraints
  -
- Version
  2.5.3
  Status
  affected
  Constraints
  -
- Version
  2.5.4
  Status
  affected
  Constraints
  -
- Version
  2.5.5
  Status
  affected
  Constraints
  -
- Version
  2.5.6
  Status
  affected
  Constraints
  -
- Version
  2.5.7
  Status
  affected
  Constraints
  -
- Version
  2.5.8
  Status
  affected
  Constraints
  -
- Version
  2.5.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Emlog Pro

n/a

Version	Status	Constraints
2.5.0	affected	-
2.5.1	affected	-
2.5.10	affected	-
2.5.11	affected	-
2.5.12	affected	-
2.5.13	affected	-
2.5.14	affected	-
2.5.15	affected	-
2.5.16	affected	-
2.5.17	affected	-
2.5.18	affected	-
2.5.2	affected	-
2.5.3	affected	-
2.5.4	affected	-
2.5.5	affected	-
2.5.6	affected	-
2.5.7	affected	-
2.5.8	affected	-
2.5.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-434

Unrestricted Upload of File

References (4)

https://github.com/lan041221/cvec/issues/8
exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.320901
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.320901
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.631923
exploitthird-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/lan041221/cvec/issues/8		exploitissue-trackingIssue TrackingThird Party Advisory
https://vuldb.com/?ctiid.320901		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.320901		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.631923		exploitthird-party-advisoryThird Party AdvisoryVDB Entry