CVE-2026-34788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34788", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:54:55.556Z", "datePublished": "2026-04-03T22:37:08.658Z", "dateUpdated": "2026-04-06T19:03:54.134Z"}, "containers": {"cna": {"title": "Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf"}], "affected": [{"vendor": "emlog", "product": "emlog", "versions": [{"version": "<= 2.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:37:08.658Z"}, "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-32mg-33qq-p3gf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T19:03:43.719671Z", "id": "CVE-2026-34788", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T19:03:54.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34788", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T19:03:43.719671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T19:03:49.760Z"}}], "cna": {"title": "Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters", "source": {"advisory": "GHSA-32mg-33qq-p3gf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "emlog", "product": "emlog", "versions": [{"status": "affected", "version": "<= 2.6.2"}]}], "references": [{"url": "https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf", "name": "https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:37:08.658Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34788", "state": "PUBLISHED", "dateUpdated": "2026-04-06T19:03:54.134Z", "dateReserved": "2026-03-30T19:54:55.556Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-03T22:37:08.658Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "emlog", "vendor": "emlog", "versions": [{"status": "affected", "version": "<= 2.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:emlog:emlog:*:*:*:*:pro:*:*:*", "matchCriteriaId": "87AE63DC-4F2B-44E3-8865-B6166722A5D6", "versionEndIncluding": "2.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "Emlog es un sistema de creaci\u00f3n de sitios web de c\u00f3digo abierto. En las versiones 2.6.2 y anteriores, existe una vulnerabilidad de inyecci\u00f3n SQL en include/model/tag_model.php en la l\u00ednea 168. La funci\u00f3n updateTagName() interpola directamente la entrada del usuario en la cadena de consulta SQL sin usar consultas parametrizadas o un escape adecuado ($this -> db -> escape_string()), lo que la hace vulnerable a ataques de inyecci\u00f3n SQL. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-34788", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34788", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T19:03:43.719671Z", "version": "2.0.3"}}]}, "published": "2026-04-03T23:17:05.063", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/emlog/emlog/security/advisories/GHSA-32mg-33qq-p3gf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "emlog", "source": "cna", "vendor": "emlog"}, "product": "emlog", "vendor": "emlog"}], "analysis": {"en": {"generated_at": "2026-04-13T19:11:02.540483+00:00", "value": {"mitigation_remediation": ["Apply any official patch or upgrade to a newer Emlog release when available", "Replace the vulnerable string concatenation with parameterized queries or proper escaping using $this->db->escape_string() in tag_model.php", "Restrict access to the tag editing functionality to trusted administrators only and disable it for other users", "Monitor database logs for anomalous SQL activity or unauthorized changes", "Verify that the updateTagName endpoint is not publicly accessible and that authentication mechanisms are correctly enforced"], "summary": {"action": "Monitor", "impact": "SQL injection enabling unauthorized database manipulation"}, "threat_synthesis": {"affected_systems": "The affected product is the open\u2011source website builder Emlog. Versions\u202f2.6.2 and earlier contain the flaw in the file include/model/tag_model.php at line\u202f168. No remedial patch is currently available from the vendor at publication, so users must rely on code changes or platform upgrades to mitigate the risk.", "description_and_impact": "The vulnerability lies in the tag_model::updateTagName() function in Emlog's core. Unsanitized user input is concatenated into an SQL statement, allowing an attacker to inject arbitrary SQL. This flaw can lead to unauthorized data extraction, modification, or deletion within the database, giving an attacker control over the application data. The weakness aligns with CWE\u201189, classification: SQL injection.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than\u202f1\u202f% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any interface that triggers updateTagName, which normally requires administrative access. Based on the description, it is inferred that an attacker must be authenticated as a user with tag\u2011editing privileges to supply a malicious tag name; however, if the endpoint is exposed to unauthenticated users, the risk increases. Exploiting the flaw would allow manipulation of database contents and potentially compromise the confidentiality, integrity, and availability of the website."}}}}, "created": "2026-04-06T21:22:05.699089+00:00", "updated": "2026-04-14T16:41:34.195719+00:00", "vendors": ["emlog", "emlog$PRODUCT$emlog"]}