CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.

• CWE-79

• https://github.com/elabftw/elabftw/issues/531Exploit, Issue Tracking, Third Party Advisory
• https://github.com/elabftw/elabftw/issues/531Exploit, Issue Tracking, Third Party Advisory

Published

Jan 3, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000472The ZipCommon::isValidPath() function in Zip/src/ZipCommon.c…
• CVE-2017-1000473Linux Dash up to version v2 is vulnerable to multiple comman…
• CVE-2017-1000474Soyket Chowdhury Vehicle Sales Management System version 201…
• CVE-2017-1000475FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Ser…
• CVE-2017-1000476ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was…
• CVE-2017-1000477XMLBundle version 0.1.7 is vulnerable to XXE attacks which c…
• CVE-2017-1000479pfSense versions 2.4.1 and lower are vulnerable to clickjack…
• CVE-2017-1000480Smarty 3 before 3.1.32 is vulnerable to a PHP code injection…
• CVE-2017-1000481When you visit a page where you need to login, Plone 2.5-5.1…
• CVE-2017-1000482A member of the Plone 2.5-5.1rc1 site could set javascript i…
• CVE-2017-1000483Accessing private content via str.format in through-the-web …
• CVE-2017-1000484By linking to a specific url in Plone 2.5-5.1rc1 with a para…