CVE-2025-43951

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter...

PT-2025-17583 · Labvantage · Labvantage

Name of the Vulnerable Software and Affected Versions: LabVantage versions prior to 8.8.0.13 HF6 Description: The issue allows local file inclusion, enabling authenticated users to retrieve arbitrary files from the environment. This is achieved via the objectname request parameter. Recommendation...

LabVantage Solutions LIMS 安全漏洞

LabVantage Solutions LIMS is a laboratory letter management system from LabVantage Solutions, USA. A security vulnerability exists in LabVantage Solutions LIMS LV prior to version 8.8.0.13 HF6, which originates from a local file inclusion and could result in the retrieval of arbitrary files...

CVE-2025-43951

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter...

CVE-2025-43951

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter...

CVE-2025-43951

LabVantage Solutions LIMS versions prior to LV 8.8.0.13 HF6 are vulnerable to a local file inclusion (LFI) flaw. Authenticated users can exploit this by using the objectname request parameter to retrieve arbitrary files from the environment. To mitigate this risk, users areARM-advised to update t...

CVE-2025-43951: External Control of File Name or Path

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via the objectname request parameter...

The vulnerability of the Labvantage LIMS file /labvantage/rc?command=page&page=LV_ViewSampleSpec&oosonly=Y&_sdialog=Y allows a attacker to execute XSS attacks.

The vulnerability of the Labvantage LIMS file /labvantage/rc?command=page&page=LVViewSampleSpec&oosonly=Y&sdialog=Y is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks through the...

The vulnerability of the Labvantage LIMS file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp&size=32 allows a attacker to execute XSS attacks.

The vulnerability of the /labvantage/rc file, with parameters command=file&file=WEB-CORE/elements/files/filesembedded.jsp&size=32, is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks via the height/width...

CVE-2024-6370

A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argumen...

CVE-2024-6370

A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argumen...

CVE-2024-6369

A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LVReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible t...

CVE-2024-6368

A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?command=page of the component POST Request Handler. The manipulation of the argument param1 leads to cross site scripting. The attack may be...

CVE-2024-6368

A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?command=page of the component POST Request Handler. The manipulation of the argument param1 leads to cross site scripting. The attack may be...

CVE-2024-6369

A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LVReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible t...

CVE-2024-6367

A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp of the component POST Request Handler. The manipulation of the argument...

CVE-2024-6367

A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp of the component POST Request Handler. The manipulation of the argument...

CVE-2024-6370 LabVantage LIMS POST Request cross site scripting

A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argumen...

CVE-2024-6370 LabVantage LIMS POST Request cross site scripting

A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argumen...

CVE-2024-6370

CVE-2024-6370 affects LabVantage LIMS 2017. A cross-site scripting flaw exists in the POST Request Handler via the file parameter /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp, by tampering the bulletinbody argument. The attack can be launched remotely and the exp...