A direct SQL injection flaw exists in Emlog’s article creation and update functions, allowing an attacker to execute arbitrary SQL commands. The effect can be a full compromise of the database, leading to data theft, permanent data loss, or destructive changes to the system. The weakness is a classic input validation bypass, corresponding to CWE‑89.

The vulnerability affects the Emlog web‑building system, specifically any deployment of the emlog:emlog product running a version older than 2.6.11. Users running those releases are at risk if they use the article creation or update interfaces.

The CVSS score of 10 indicates a critical severity. The EPSS score was not disclosed in the CVE data, so it is unknown at this time; this is inferred from the 'not available' noted in the source. Because the vulnerable functions are exposed through the public web interface and do not require elevated privileges, the potential for exploitation is high. The likely attack vector is the article creation or update form, sending malicious SQL payloads that bypass unvalidated input handling; this is inferred since the CVE description does not explicitly specify the vector. The flaw is not listed in CISA KEV, but its remote nature means that unauthenticated or low‑privilege users could inject commands simply by submitting content.