Is CVE-2026-46686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46686 being exploited in the wild.

How severe is CVE-2026-46686?

Informational severity, with a CVSS score of 8.5, published 16 July 2026.

Is there a fix for CVE-2026-46686?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-46686 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46686?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46686: Emlog reflected cross-site scripting in admin user search

CVE-2026-46686 · Severity: info · CVSS 8.5 · Published 2026-07-16

Emlog is an open-source website building system. A security flaw in the administrative dashboard allows an attacker to execute malicious scripts in the browser of a logged-in administrator. If an administrator clicks a specially crafted link, the attacker could steal their login session, access sensitive user data, or perform unauthorized administrative actions.

Quick answers

Is CVE-2026-46686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46686 being exploited in the wild.
How severe is CVE-2026-46686?: Informational severity, with a CVSS score of 8.5, published 16 July 2026.
Which products and versions are affected?: Emlog Emlog Pro <= 2.6.13.
Is there a fix for CVE-2026-46686?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-46686 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46686?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the admin user management search functionality (admin/user.php). The 'keyword' GET parameter is processed using addslashes(), which escapes quotes for SQL safety but fails to neutralize HTML special characters. This value is then directly rendered into the 'value' attribute of an input tag in admin/views/user.php without HTML encoding. An attacker can bypass the addslashes() protection by using characters like '>' to break out of the attribute and inject arbitrary script tags. Successful exploitation requires an authenticated administrator to click a malicious URL, potentially leading to session hijacking via cookie theft. No official patch has been identified, though manual remediation via htmlspecialchars() is recommended.

Affected products

Emlog Emlog Pro <= 2.6.13

Timeline

2026-05-13: advisory: GitHub Security Advisory published by vendor
2026-07-16: disclosed: CVE published to NVD dataset

References

https://github.com/emlog/emlog/security/advisories/GHSA-3h87-c3m2-jpj9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.