CVE-2025-47784
Critical
Description
Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEmlog
PublishedMay 15, 2025
First seenMay 15, 2025
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- emlog emlog2.5.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emlog emlog | v < 2.5.14 | 2.5.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.