Skip to content
Noroxi

elabftw records

17 published records for vendor elabftw.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
23.5%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

17 records
  • CVE-2019-12185
    40Plan

    eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component.

    HighCVSS 8.8Proof of conceptEPSS 17%

    elabftw · elabftwMay 19, 2019

  • CVE-2021-43834
    39Monitor

    Incorrect Authentication in elabftw

    CriticalCVSS 9.8No exploitEPSS 1%

    elabftw · elabftwDec 15, 2021

  • CVE-2022-31007
    36Monitor

    Privilege escalation from administrator in eLabFTW

    HighCVSS 7.2Proof of conceptEPSS 26%

    elabftw · elabftwMay 31, 2022

  • CVE-2021-41171
    36Monitor

    Bypass bruteforce protection on login form in elabftw

    HighCVSS 8.8No exploitEPSS 1%

    elabftw · elabftwOct 22, 2021

  • CVE-2021-43833
    35Monitor

    Account takeover in eLabFTW

    HighCVSS 8.8No exploitEPSS 0%

    elabftw · elabftwDec 15, 2021

  • CVE-2025-25206
    35Monitor

    Incorrect input validation could allow an authenticated user to read sensitive information

    HighCVSS 8.8No exploitEPSS 0%

    elabftw · elabftwFeb 14, 2025

  • CVE-2024-25632
    35Monitor

    Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances

    HighCVSS 8.8No exploitEPSS 0%

    elabftw · elabftwOct 1, 2024

  • CVE-2024-52586
    31Monitor

    eLabFTW is an open source electronic lab notebook for research labs.

    HighCVSS 7.8No exploitEPSS 0%

    elabftw · elabftwDec 9, 2024

  • CVE-2024-45408
    26Monitor

    eLabFTW contains a direct and indirect information disclosure

    MediumCVSS 6.5No exploitEPSS 0%

    elabftw · elabftwOct 1, 2024

  • CVE-2024-47826
    24Monitor

    eLabFTW vulnerable to HTML Injection in extended search error message

    MediumCVSS 6.1No exploitEPSS 0%

    elabftw · elabftwOct 14, 2024

  • CVE-2026-28510
    23Monitor

    elabftw allows MFA bypass during login

    MediumCVSS 5.9No exploitEPSS 0%

    elabftw · elabftwMay 5, 2026

  • CVE-2017-1000478
    21Monitor

    ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of Jav

    MediumCVSS 5.4No exploitEPSS 0%

    elabftw · elabftwJan 3, 2018

  • CVE-2024-28100
    21Monitor

    Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

    MediumCVSS 5.4No exploitEPSS 0%

    elabftw · elabftwSep 2, 2024

  • CVE-2024-25633
    21Monitor

    In eLabFTW, if administrators can create users, users can too

    MediumCVSS 5.4No exploitEPSS 0%

    elabftw · elabftwAug 15, 2024

  • CVE-2021-32698
    19Monitor

    Blind Server-Side Request Forgery (SSRF) in eLabFTW

    MediumCVSS 4.9No exploitEPSS 0%

    elabftw · elabftwJun 21, 2021

  • CVE-2022-31178
    17Monitor

    Improper Authorization in eLabFTW

    MediumCVSS 4.3No exploitEPSS 0%

    elabftw · elabftwAug 1, 2022

  • CVE-2026-28511
    17Monitor

    elabftw has entry title leakage through autocompletion search

    MediumCVSS 4.3No exploitEPSS 0%

    elabftw · elabftwJun 1, 2026