CVE-2024-47826— eLabFTW vulnerable to HTML Injection in extended search error message
Quick assessment
Affected
elabftw elabftw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
eLabFTW是eLabFTW开源的一套开源的实验数据托管平台。该平台运行于Linux系统中，并支持存储多种对象。 eLabFTW 5.1.5之前版本存在代码注入漏洞。攻击者利用该漏洞可以执行任意javascript。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-47826
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
eLabFTW vulnerable to HTML Injection in extended search error message
Source: CVE Program / CVE List V5
Vulnerability Description
eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
eLabFTW 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
eLabFTW是eLabFTW开源的一套开源的实验数据托管平台。该平台运行于Linux系统中，并支持存储多种对象。 eLabFTW 5.1.5之前版本存在代码注入漏洞。攻击者利用该漏洞可以执行任意javascript。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-47826
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47826
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: elabftw
-
CVE-2026-28511
elabftw has entry title leakage through autocompletion searc -
CVE-2026-28510
elabftw allows MFA bypass during login -
CVE-2025-62793
eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads -
CVE-2025-25206
Incorrect input validation could allow an authenticated user -
CVE-2024-52586
eLabFTW MFA bypass
Same vendor: elabftw
-
CVE-2026-28511
elabftw has entry title leakage through autocompletion searc -
CVE-2026-28510
elabftw allows MFA bypass during login -
CVE-2025-62793
eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads -
CVE-2025-25206
Incorrect input validation could allow an authenticated user -
CVE-2024-52586
eLabFTW MFA bypass
Same weakness: CWE-79
-
CVE-2026-107303
JHipster: Generated Applications Allow Stored XSS via Unrest -
CVE-2026-104078
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass -
CVE-2026-104077
Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown -
CVE-2026-105831
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection -
CVE-2026-13258
IBM DataPower Gateway Cross-Site Scripting
V. Comments for CVE-2024-47826
No comments yet