elabftw vulnerabilities

CVEs per yearBy the year they were published

1. 20214
2. 20222
3. 20246
4. 20252
5. 20262

Newest CVEs

• CVE-2026-28511

  elabftw has entry title leakage through autocompletion search

  elabftw · elabftw

  Medium4.3
• CVE-2026-28510

  elabftw allows MFA bypass during login

  elabftw · elabftw

  Medium5.9
• CVE-2025-62793

  eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking

  elabftw · elabftw

  Medium6.8
• CVE-2025-25206

  Incorrect input validation could allow an authenticated user to read sensitive information

  elabftw · elabftw

  High8.3
• CVE-2024-52586

  eLabFTW MFA bypass

  elabftw · elabftw

  Medium5.4
• CVE-2024-47826

  eLabFTW vulnerable to HTML Injection in extended search error message

  elabftw · elabftw

  Low3.5
• CVE-2024-45408

  eLabFTW contains a direct and indirect information disclosure

  elabftw · elabftw

  High7.5
• CVE-2024-25632

  Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances

  elabftw · elabftw

  High8.6
• CVE-2024-28100

  Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

  elabftw · elabftw

  High8.9
• CVE-2024-25633

  In eLabFTW, if administrators can create users, users can too

  elabftw · elabftw

  Medium5.4