Vulnerabilities

TI-2026-22773 CVE-2026-28511

elabftw has entry title leakage through autocompletion search

LOW 19

eLabFTW is an open source electronic lab notebook.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00186 Published 2026-06-01 Fixed in 5.4.2 CWE-200

TI-2026-22772 CVE-2026-28510

elabftw allows MFA bypass during login

LOW 28

eLabFTW is an open source electronic lab notebook.

CVSS 3.1MEDIUM 5.9 Network High privileges No interaction EPSS 0.00254 Published 2026-05-05 No fix listed CWE-302

TI-2025-18875 CVE-2025-25206

Incorrect input validation could allow an authenticated user to read sensitive information

MEDIUM 41

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00485 Published 2025-02-14 Fixed in 5.1.15 CWE-89

TI-2024-35246 CVE-2024-52586

eLabFTW MFA bypass

LOW 33

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00212 Published 2024-12-09 Fixed in 5.1.9 CWE-288

TI-2024-32093 CVE-2024-47826

eLabFTW vulnerable to HTML Injection in extended search error message

LOW 27

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00295 Published 2024-10-14 Fixed in 5.1.5 CWE-79

TI-2024-30457 CVE-2024-45408

eLabFTW contains a direct and indirect information disclosure

LOW 39

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00392 Published 2024-10-01 Fixed in 5.1.0 CWE-284

TI-2024-16860 CVE-2024-25632

Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances

LOW 38

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00396 Published 2024-10-01 Fixed in 5.1.0 CWE-266

TI-2024-18681 CVE-2024-28100

Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

LOW 38

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00334 Published 2024-09-02 Fixed in 5.0.0 CWE-79

TI-2024-16861 CVE-2024-25633

In eLabFTW, if administrators can create users, users can too

LOW 24

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2024-08-15 Fixed in 5.0.0 CWE-266

TI-2022-13218 CVE-2022-31178

Improper Authorization in eLabFTW

LOW 21

eLabFTW is an electronic lab notebook manager for research teams.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2022-08-01 Fixed in 4.3.4 CWE-863

TI-2022-13053 CVE-2022-31007

Privilege escalation from administrator in eLabFTW

MEDIUM 54

eLabFTW is an electronic lab notebook manager for research teams.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.26948 Published 2022-05-31 Fixed in 4.3.0 CWE-1287

TI-2021-19640 CVE-2021-43834

Incorrect Authentication in elabftw

MEDIUM 44

eLabFTW is an electronic lab notebook manager for research teams.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0101 Published 2021-12-15 Fixed in 4.2.0 CWE-287

TI-2021-19639 CVE-2021-43833

Account takeover in eLabFTW

MEDIUM 40

eLabFTW is an electronic lab notebook manager for research teams.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0084 Published 2021-12-15 Fixed in 4.2.0 CWE-287

TI-2021-18010 CVE-2021-41171

Bypass bruteforce protection on login form in elabftw

MEDIUM 42

eLabFTW is an open source electronic lab notebook manager for research teams.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01945 Published 2021-10-22 Fixed in 4.1.0 CWE-307

TI-2021-12366 CVE-2021-32698

Blind Server-Side Request Forgery (SSRF) in eLabFTW

LOW 32

eLabFTW is an open source electronic lab notebook for research labs.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00936 Published 2021-06-21 Fixed in 4.0.0 CWE-918

TI-2019-09101 CVE-2019-12185 · GHSA-fv76-64ff-h2vm

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the…

MEDIUM 55

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.17336 Published 2019-05-19 No fix listed CWE-434

TI-2017-14687 CVE-2017-1000478 · GHSA-9f86-mv3h-fcpq

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment…

LOW 26

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00771 Published 2018-01-03 No fix listed CWE-79

Vulnerabilities

Filters