PT-2025-42725

CVE-2025-11946

Published

2025-10-19

Updated

2025-11-07

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions up to 9.2.1

Description A security issue exists in LogicalDOC Community Edition. The problem is related to processing within the /frontend.jsp file of the Add Contact Page component. Manipulation of the First Name, Last Name, Company, Address, Phone, or Mobile arguments can lead to cross site scripting. Remote exploitation is possible, and an exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 9.2.1 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers