CVE-2026-53756— Emlog Blind SQL Injection via Authentication Cookie
Quick assessment
Affected
emlog emlog
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Emlog 是一个开源的网站构建系统。在 2.6.16 版本之前，Emlog CMS Pro 的 函数存在盲注型 SQL 注入漏洞。 参数在未进行任何过滤的情况下，被直接拼接进 SQL 查询语句中。该漏洞可通过认证 Cookie 校验路径触发：从 Cookie 中提取的 未被过滤即传入 SQL 语句，其唯一的安全防护是依赖 进行 HMAC 签名验证，攻击者需要该密钥来伪造签名。此问题已在 2.6.16 版本中修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53756
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Emlog Blind SQL Injection via Authentication Cookie
Source: CVE Program / CVE List V5
Vulnerability Description
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-53756
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53756
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53756 (1)
Vendor Advisories for CVE-2026-53756 (1)
Vendor Pages for CVE-2026-53756 (1)
-
🔗 Release pro-2.6.16 · emlog/emlog · GitHub x_refsource_MISC
Same Patch Batch · emlog · 2026-09-04 · 4 CVEs total
| CVE-2026-53758 | 8.7 HIGH | Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized |
| CVE-2026-53757 | 6.9 MEDIUM | Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE |
| CVE-2026-73848 | 6.9 MEDIUM | Emlog: Stored XSS via Tag Name in Article Editor |
IV. Related Vulnerabilities
Same product: emlog
-
CVE-2026-73848
Emlog: Stored XSS via Tag Name in Article Editor -
CVE-2026-53757
Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload -
CVE-2026-53758
Emlog: Stored XSS via Parsedown Markdown Processing - Raw HT -
CVE-2026-73850
Emlog: Arbitrary SQL Execution Vulnerability in ai.php withi -
CVE-2026-73849
emlog allows unauthenticated reinstallation via `install.php
Same vendor: emlog
-
CVE-2026-73848
Emlog: Stored XSS via Tag Name in Article Editor -
CVE-2026-53757
Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload -
CVE-2026-53758
Emlog: Stored XSS via Parsedown Markdown Processing - Raw HT -
CVE-2026-73850
Emlog: Arbitrary SQL Execution Vulnerability in ai.php withi -
CVE-2026-73849
emlog allows unauthenticated reinstallation via `install.php
Same weakness: CWE-89
-
CVE-2026-52775
YesWiki Authenticated SQL Injection in ReactionManager -
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via U -
CVE-2026-52770
Improper Neutralization of Special Elements used in an SQL C -
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `perio -
CVE-2026-85643
code-projects Online Shopping System adduser.php mysqli_quer
V. Comments for CVE-2026-53756
No comments yet