CVE-2025-25783

Critical · CVSS 9.8

Emlog Pro — Arbitrary File Upload leading to Remote Code Execution

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-434

Description

An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.

Search profile — drives PoC discovery

Symbols admin\plugin.phpadmin/plugin.phpplugin.phpZip file uploadcrafted Zip

Keywords CVE-2025-25783Emlog ProEmlog Pro v2.5.3arbitrary file uploadplugin.phpzip upload RCECWE-434emlog plugin upload exploitemlog pro poc

Versions: Emlog Pro v2.5.3

References

https://github.com/Ka7arotto/emlog/blob/main/emlog-3.md
https://www.emlog.net/
https://github.com/Ka7arotto/emlog/blob/main/emlog-3.md

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z