Advisories · Technology
elabftw.
Every CVE that names elabftw among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
elabftw has entry title leakage through autocompletion search
- elabftw
- Information disclosure
- CVSS 5.9 Medium
elabftw allows MFA bypass during login
- elabftw
- CWE-302
- CVSS 6.8 Medium
eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking
- elabftw
- Cross-site scripting (XSS)
- CVSS 8.3 High
Incorrect input validation could allow an authenticated user to read sensitive information
- elabftw
- SQL injection
- CVSS 5.4 Medium
eLabFTW MFA bypass
- elabftw
- Authentication bypass
- CVSS 3.5 Low
eLabFTW vulnerable to HTML Injection in extended search error message
- elabftw
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
eLabFTW contains a direct and indirect information disclosure
- elabftw
- Broken access control
- CVSS 8.6 High
Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances
- elabftw
- Privilege escalation
- CWE-842
- CVSS 8.9 High
Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
- elabftw
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
In eLabFTW, if administrators can create users, users can too
- elabftw
- Privilege escalation
- CVSS 4.3 Medium
Improper Authorization in eLabFTW
- elabftw
- Broken access control
- CVSS 4.9 Medium
Privilege escalation from administrator in eLabFTW
- elabftw
- CWE-842
- CWE-1287
- CVSS 9.1 CriticalCritical · CVSS 9+
Incorrect Authentication in elabftw
- elabftw
- Authentication bypass
- CVSS 8.1 High
Account takeover in eLabFTW
- elabftw
- Authentication bypass
- CVSS 5.9 Medium
Bypass bruteforce protection on login form in elabftw
- elabftw
- Authentication bypass
- CVSS 6.8 Medium
Blind Server-Side Request Forgery (SSRF) in eLabFTW
- elabftw
- Server-side request forgery (SSRF)