Eelabftw

Products

Exploited and recent CVEs

• CVE-2026-28511 Medium 4.3 elabftw has entry title leakage through autocompletion search 0.2%
• CVE-2026-28510 Medium 5.9 elabftw allows MFA bypass during login 0.3%
• CVE-2025-62793 Medium 6.8 eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking 0.3%
• CVE-2025-25206 High 8.3 Incorrect input validation could allow an authenticated user to read sensitive information 0.5%
• CVE-2024-52586 Medium 5.4 eLabFTW MFA bypass 0.2%
• CVE-2024-47826 Low 3.5 eLabFTW vulnerable to HTML Injection in extended search error message 0.3%
• CVE-2024-45408 High 7.5 eLabFTW contains a direct and indirect information disclosure 0.4%
• CVE-2024-25632 High 8.6 Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances 0.4%
• CVE-2024-28100 High 8.9 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw 0.3%
• CVE-2024-25633 Medium 5.4 In eLabFTW, if administrators can create users, users can too 0.2%
• CVE-2022-31178 Medium 4.3 Improper Authorization in eLabFTW 0.5%
• CVE-2022-31007 Medium 4.9 Privilege escalation from administrator in eLabFTW 26.9%
• CVE-2021-43834 Critical 9.1 Incorrect Authentication in elabftw 1.0%
• CVE-2021-43833 High 8.1 Account takeover in eLabFTW 0.8%
• CVE-2021-41171 Medium 5.9 Bypass bruteforce protection on login form in elabftw 1.9%
• CVE-2021-32698 Medium 6.8 Blind Server-Side Request Forgery (SSRF) in eLabFTW 0.9%