A high-severity reflected cross-site scripting vulnerability in Emlog Pro allows unauthenticated remote attackers to execute malicious scripts in the context of an administrator's session.

The application fails to properly sanitize user-supplied input in the keyword parameter, which is a classic instance of CWE-79 (Cross-site Scripting). An unauthenticated attacker can craft a malicious link that, when clicked by an administrator, executes arbitrary JavaScript within their browser session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized administrative actions, or the theft of sensitive session tokens. With a CVSS score of 8.2, this flaw poses a significant risk to the integrity and confidentiality of the website management system, as it grants attackers a path to compromise administrative accounts.

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected search functionality or disable the keyword search feature if it is not business-critical.

Proactive Monitoring: Review web access logs for anomalous requests containing script tags or encoded characters in the keyword parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules configured to block common XSS payloads targeting the keyword parameter.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the severity of this vulnerability and the lack of an available patch, immediate mitigation is necessary to protect administrative sessions. Organizations should implement WAF rules to filter malicious input and monitor for suspicious activity until the vendor releases a secure version of the software.