The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious script into content that is subsequently rendered in other users’ browsers. Because the script executes with the privileges of the victim’s session, an attacker can hijack user accounts, including administrative accounts. This is classified as CWE-79.

The affected product is Emlog version 2.5.23. No patched version is available at the time of publication, and the vulnerability is specific to that release.

The CVSS score of 6.8 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a very low likelihood that the vulnerability is actively exploited. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to be able to write or edit content that will be stored and displayed to other users. Once the content is rendered in another user’s browser, the stored script can be executed, giving the attacker control of that user’s session. The lack of an immediate patch means the risk persists until a fix or adequate workaround is deployed.