CVE-2026-88745

Deferred Deferred - Pending Action

XSS Vulnerability in EMLOG-Pro Allows Malicious Shell Upload

Publication date: 2026-09-21

Last updated on: 2026-09-22

Assigner: MITRE

Description

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-22

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-10

NVD

CVE-2026-88745

Affected Vendors & Products

Vendor	Product	Version / Range
emlog	emlog	2.6.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

EMLOG-Pro 2.6.29 has a cross-site scripting (XSS) vulnerability that allows attackers to upload a malicious shell. This means an attacker can inject malicious scripts into the application, potentially gaining unauthorized access or control over the system.

Detection Guidance

To detect this XSS vulnerability in EMLOG-Pro 2.6.29, inspect web server logs for unusual file uploads or requests containing script tags. Check for files with extensions like .php or .html in upload directories. Use commands like 'grep -r "<script>" /var/www/html' to search for injected scripts.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code on your server, steal sensitive data, or take control of your website. It may lead to data breaches, defacement, or further compromise of your system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches. It may result in legal penalties, loss of trust, and reputational damage.

Mitigation Strategies

Immediately update EMLOG-Pro to the latest patched version. Disable file uploads if not required. Implement strict input validation for user uploads. Monitor network traffic for suspicious shell activity.

Hi! I’m here to help you understand CVE-2026-88745. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70