CVE-2025-11946
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A security flaw was discovered in LogicalDOC Community Edition up to 9.2.1 affecting /frontend.jsp in the Add Contact Page component. Manipulation of First Name/Last Name/Company/Address/Phone/Mobile arguments results in cross site scripting, and the exploit has been publicly released.
Risk Assessment
A remote attacker can execute malicious script in a victim's browser, potentially hijacking sessions or credentials. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update LogicalDOC to a version later than 9.2.1 once the vendor releases a fix. Until then, restrict access to the interface and enforce server-side input validation.
Other vulnerabilities in LogicalDOC Community Edition
See all- CVE-2017-1000022High
LogicalDoc Community Edition 7.5.3 and prior contain an incorrect access control which could lead to privilege escalation.
- CVE-2017-1000021High
LogicalDoc Community Edition version 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2025-12546Low
LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS