PT-2025-42725 · Logicaldoc · Logicaldoc Community Edition

Zeeshan Khan · Published 2025-10-19 · Updated 2025-11-07 · CVE-2025-11946

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions up to 9.2.1

Description A security issue exists in LogicalDOC Community Edition. The problem is related to processing within the /frontend.jsp file of the Add Contact Page component. Manipulation of the First Name, Last Name, Company, Address, Phone, or Mobile arguments can lead to cross site scripting. Remote exploitation is possible, and an exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 9.2.1 should be updated.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-11946

Affected Products

Logicaldoc Community Edition

References · 12

• 🔥 https://gist.github.com/thezeekhan/231d87163fbb84f94c9c94f13b88db90 · Exploit
• 🔥 https://gist.github.com/thezeekhan/231d87163fbb84f94c9c94f13b88db90#steps-to-reproduce · Exploit
• https://osv.dev/vulnerability/CVE-2025-11946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11946 · Security Note
• https://t.me/cveNotify/139353 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980040202170106020 · Twitter Post
• https://vuldb.com/?ctiid.329026 · Note
• https://t.me/CVEtracker/35291 · Telegram Post
• https://t.me/cveNotify/142027 · Telegram Post
• https://vuldb.com/?submit.671389 · Note
• https://vuldb.com/?id.329026 · Note
• https://twitter.com/CVEnew/status/1980028816333410504 · Twitter Post