CVE-2026-53756

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge. This issue has been patched in version 2.6.16.

• CWE-89

• https://github.com/emlog/emlog/commit/92b6eea618891b28ed0c520564dff26e170645b4
• https://github.com/emlog/emlog/releases/tag/pro-2.6.16
• https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg
• https://github.com/emlog/emlog/security/advisories/GHSA-xq97-53c2-vvfg

Published

Sep 4, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5375An issue that could allow a user with access to a credential…2.7
• CVE-2026-53751DataEase is an open source data visualization and analysis t…8.7
• CVE-2026-53752docx4j is an open source Java library for creating, editing,…7.5
• CVE-2026-53753Crawl4AI is an open-source LLM friendly web crawler & scrape…10
• CVE-2026-53754Crawl4AI is an open-source LLM friendly web crawler & scrape…7.5
• CVE-2026-53755Crawl4AI is an open-source LLM friendly web crawler & scrape…7.5
• CVE-2026-53757Emlog is an open source website building system. In versions…6.9
• CVE-2026-53758Emlog is an open source website building system. In versions…8.7
• CVE-2026-53759linuxfabrik-lib provides Python modules for database access,…2
• CVE-2026-5376An issue that could prevent session inactivity timeouts from…5.9
• CVE-2026-53760Admidio is an open-source user management solution. In versi…5.2
• CVE-2026-53761Frappe CRM is an open-source customer relationship managemen…8.2