CVE-2019-25258 | High | 7.5 | 2025-12-24 | LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverifi… |
CVE-2025-12547 | Low | 3.7 | 2025-10-31 | A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Adm… |
CVE-2025-12546 | Low | 3.5 | 2025-10-31 | A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulatio… |
CVE-2025-11946 | Low | 3.5 | 2025-10-19 | A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the co… |
CVE-2024-54449 | High | 8.8 | 2025-03-14 | The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with contro… |
CVE-2024-54448 | High | 7.2 | 2025-03-14 | The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with admin… |
CVE-2024-54447 | | | 2025-03-14 | Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacke… |
CVE-2024-54446 | | | 2025-03-14 | Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the att… |
CVE-2024-54445 | | | 2025-03-14 | Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can… |
CVE-2024-12245 | | | 2025-03-14 | Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker ca… |
CVE-2024-12020 | Medium | 6.1 | 2025-03-14 | There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into… |
CVE-2024-12019 | | | 2025-03-14 | The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyin… |
CVE-2022-47418 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document ver… |
CVE-2022-47417 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document fil… |
CVE-2022-47416 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system. |
CVE-2022-47415 | Medium | 5.4 | 2023-02-07 | LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messa… |
CVE-2020-13542 | High | 7.8 | 2020-12-03 | A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker c… |
CVE-2020-10366 | High | 7.5 | 2020-04-08 | LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365. |
CVE-2020-9423 | Critical | 9.8 | 2020-03-18 | LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc prov… |
CVE-2020-10365 | Medium | 6.5 | 2020-03-18 | LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the database. This list could be filtered by mod… |
CVE-2019-9723 | High | 7.1 | 2019-05-30 | LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the cl… |
CVE-2017-1000023 | Medium | 5.4 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. |
CVE-2017-1000022 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. |
CVE-2017-1000021 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. |