PT-2025-44662 · Logicaldoc · Logicaldoc Community Edition

Zeeshan Khan · Published 2025-10-31 · Updated 2025-11-07 · CVE-2025-12546

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions up to 9.2.1

Description A security issue exists in LogicalDOC Community Edition related to the API Key creation UI. This issue allows for cross site scripting. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 9.2.1 should be updated.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-12546

Affected Products

Logicaldoc Community Edition

References · 10

• 🔥 https://gist.github.com/thezeekhan/fa0dcfda4f1f915c625d3f89f8ec0529 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12546 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12546 · Vendor Advisory
• https://twitter.com/CVEnew/status/1984337728381812964 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984408562571833641 · Twitter Post
• https://vuldb.com/?ctiid.330806 · Note
• https://t.me/cveNotify/142039 · Telegram Post
• https://vuldb.com/?id.330806 · Note
• https://t.me/CVEtracker/36336 · Telegram Post
• https://vuldb.com/?submit.677170 · Note