CVE-2020-7959

MEDIUM

LabVantage LIMS 8.3 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-7959. PoCs published by Joel Aviad Ossi.

AI-analyzed exploit summary This exploit targets LabVantage 8.3 to disclose database names and versions by parsing HTML responses from vulnerable endpoints. It includes functionality to check for vulnerability and enumerate database names via crafted requests.

Description

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognized Database exception message if the database does not exist.

Exploits (1)

exploitdb WORKING POC
by Joel Aviad Ossi · pythonwebappsjava
https://www.exploit-db.com/exploits/48090

This exploit targets LabVantage 8.3 to disclose database names and versions by parsing HTML responses from vulnerable endpoints. It includes functionality to check for vulnerability and enumerate database names via crafted requests.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: LabVantage 8.3
No auth needed
Prerequisites: Network access to the target LabVantage instance · Exposed /labservices/logon.jsp or /labservices/rc endpoints
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/48090

Scores

CVSS v3 5.3
EPSS 0.0138
EPSS Percentile 68.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-203
Status published
Products (1)
labvantage/labvantage 8.3
Published Feb 17, 2020
Tracked Since Feb 18, 2026