Elabftw vulnerabilities

Products

• Elabftw 18

Newest

• elabftw elabftw has entry title leakage through autocompletion search CVE-2026-28511 4.3 MediumJune 1, 2026
• elabftw elabftw allows MFA bypass during login CVE-2026-28510 5.9 MediumMay 5, 2026
• elabftw eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking CVE-2025-62793 6.8 MediumOctober 27, 2025
• elabftw Incorrect input validation could allow an authenticated user to read sensitive information CVE-2025-25206 8.3 HighFebruary 14, 2025
• elabftw eLabFTW MFA bypass CVE-2024-52586 5.4 MediumDecember 9, 2024
• elabftw eLabFTW vulnerable to HTML Injection in extended search error message CVE-2024-47826 3.5 LowOctober 14, 2024
• elabftw eLabFTW contains a direct and indirect information disclosure CVE-2024-45408 7.5 HighOctober 1, 2024
• elabftw Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances CVE-2024-25632 8.6 HighOctober 1, 2024
• elabftw Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw CVE-2024-28100 8.9 HighSeptember 2, 2024
• elabftw In eLabFTW, if administrators can create users, users can too CVE-2024-25633 5.4 MediumAugust 15, 2024
• elabftw Improper Authorization in eLabFTW CVE-2022-31178 4.3 MediumAugust 1, 2022
• elabftw Privilege escalation from administrator in eLabFTW CVE-2022-31007 Public exploit EPSS 26.9% 4.9 MediumMay 31, 2022
• elabftw Incorrect Authentication in elabftw CVE-2021-43834 9.1 CriticalDecember 15, 2021
• elabftw Account takeover in eLabFTW CVE-2021-43833 8.1 HighDecember 15, 2021
• elabftw Bypass bruteforce protection on login form in elabftw CVE-2021-41171 5.9 MediumOctober 22, 2021
• elabftw Blind Server-Side Request Forgery (SSRF) in eLabFTW CVE-2021-32698 6.8 MediumJune 21, 2021
• elabftw eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController... CVE-2019-12185 Public exploit EPSS 17.3% 8.8 HighMay 19, 2019
• elabftw ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos... CVE-2017-1000478 5.4 MediumJanuary 3, 2018