Vulnerability Description
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.
Related Weaknesses (CWE)
References
- https://github.com/emlog/emlog/security/advisories/GHSA-3h87-c3m2-jpj9
- https://github.com/emlog/emlog/security/advisories/GHSA-3h87-c3m2-jpj9
FAQ
What is CVE-2026-46686?
CVE-2026-46686 is a documented vulnerability. Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped b...
How severe is CVE-2026-46686?
CVSS scoring is not yet available for CVE-2026-46686. Check NVD for updates.
Is there a patch for CVE-2026-46686?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.