CVE-2025-12546
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker could inject malicious scripts, potentially leading to session theft, account takeover, or other attacks against system users.
Recommendation
Update LogicalDOC to a patched version. Restrict access to the API key creation UI and monitor activity.
Other vulnerabilities in LogicalDOC Community Edition
See allOriginal NVD description (English source)
A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS