The vulnerability lies in the tag_model::updateTagName() function in Emlog's core. Unsanitized user input is concatenated into an SQL statement, allowing an attacker to inject arbitrary SQL. This flaw can lead to unauthorized data extraction, modification, or deletion within the database, giving an attacker control over the application data. The weakness aligns with CWE‑89, classification: SQL injection.

The affected product is the open‑source website builder Emlog. Versions 2.6.2 and earlier contain the flaw in the file include/model/tag_model.php at line 168. No remedial patch is currently available from the vendor at publication, so users must rely on code changes or platform upgrades to mitigate the risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any interface that triggers updateTagName, which normally requires administrative access. Based on the description, it is inferred that an attacker must be authenticated as a user with tag‑editing privileges to supply a malicious tag name; however, if the endpoint is exposed to unauthenticated users, the risk increases. Exploiting the flaw would allow manipulation of database contents and potentially compromise the confidentiality, integrity, and availability of the website.