{"id":"CVE-2025-25206","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-25206","generatedAt":"2026-10-28T03:55:45.225Z","title":"Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database.","description":"eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if cookies are enabled (default setting). Users must upgrade to eLabFTW version 5.1.15 to receive a fix. No known workarounds are available.","published":"2025-02-14T17:15:19.000Z","lastModified":"2026-06-17T09:00:29.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-89"],"affected":["elabftw/elabftw"],"epss":{"score":0.00485,"percentile":0.41534,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/elabftw/elabftw/releases/tag/5.1.15","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/elabftw/elabftw/security/advisories/GHSA-qffc-rfjh-77gg","tags":["Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-25206","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}