CVE-2026-73848
NONE—CVSS v3
—CVSS v2
0.32%
EPSS (exploit probability)
CWE-79CWE
Description
Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ');alert(document.domain);//. The addslashes() function does not escape HTML entities, so ' is stored as-is. When the browser renders the page, it decodes ' back to a literal single quote before evaluating the JavaScript, breaking out of the string and executing arbitrary code. At time of publication, there are no publicly known patches.
Affected routers (0)
No routers currently mapped to this CVE in our database.