CVE-2024-28100

eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a list of experiments. Viewing this allows the malicious script to act on behalf of the visitor in any way, including the creation of API keys for persistence, or other options normally available to the user. If the user viewing the page has the sysadmin role in eLabFTW, the script can act as a sysadmin (including system configuration and extensive user management roles). Users are advised to upgrade to at least version 5.0.0. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://github.com/elabftw/elabftw/security/advisories/GHSA-xp3v-w8cx-cqxcVendor Advisory

Published

Sep 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28095News functionality in Schoolbox application before version …5.4
• CVE-2024-28096Class functionality in Schoolbox application before version…5.4
• CVE-2024-28097Calendar functionality in Schoolbox application before vers…5.4
• CVE-2024-28098The vulnerability allows authenticated users with only produ…5.4
• CVE-2024-28099VT STUDIO Ver.8.32 and earlier contains an issue with the DL…7.8
• CVE-2024-2810A vulnerability has been found in Tenda AC15 15.03.05.18/15.…9.8
• CVE-2024-28101The Apollo Router is a graph router written in Rust to run a…7.5
• CVE-2024-28102JWCrypto implements JWK, JWS, and JWE specifications using p…6.8
• CVE-2024-28103Action Pack is a framework for handling and responding to we…9.8
• CVE-2024-28105phpMyFAQ is an open source FAQ web application for PHP 8.1+ …7.2
• CVE-2024-28106phpMyFAQ is an open source FAQ web application for PHP 8.1+ …5.4
• CVE-2024-28107phpMyFAQ is an open source FAQ web application for PHP 8.1+ …8.8