# cve.now: Logicaldoc

The newest entries naming Logicaldoc as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109206](https://cve.now/CVE-2026-109206.md): LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet (CVSS 6.9)
- [CVE-2026-109205](https://cve.now/CVE-2026-109205.md): LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet (CVSS 8.7)
- [CVE-2026-109204](https://cve.now/CVE-2026-109204.md): LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket (CVSS 5.3)
- [CVE-2026-109203](https://cve.now/CVE-2026-109203.md): LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet (CVSS 7.1)
- [CVE-2026-109202](https://cve.now/CVE-2026-109202.md): LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet (CVSS 7.1)
- [CVE-2026-109201](https://cve.now/CVE-2026-109201.md): LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService (CVSS 8.7)
- [CVE-2026-109200](https://cve.now/CVE-2026-109200.md): LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href (CVSS 5.3)
- [CVE-2026-109199](https://cve.now/CVE-2026-109199.md): LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template (CVSS 8.7)
- [CVE-2026-109170](https://cve.now/CVE-2026-109170.md): LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter (CVSS 7.1)
- [CVE-2026-109169](https://cve.now/CVE-2026-109169.md): LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter (CVSS 7.1)
- [CVE-2019-25258](https://cve.now/CVE-2019-25258.md): LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities (CVSS 7.1)
- [CVE-2019-25257](https://cve.now/CVE-2019-25257.md): LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation (CVSS 8.7)
- [CVE-2025-12547](https://cve.now/CVE-2025-12547.md): LogicalDOC Community Edition Admin Login login.jsp excessive authentication (CVSS 6.3)
- [CVE-2025-12546](https://cve.now/CVE-2025-12546.md): LogicalDOC Community Edition API Key creation UI cross site scripting (CVSS 5.1)
- [CVE-2025-11946](https://cve.now/CVE-2025-11946.md): LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting (CVSS 5.1)
- [CVE-2024-12245](https://cve.now/CVE-2024-12245.md): Blind SQL Injection in Logout (CVSS 8.7)
- [CVE-2024-12020](https://cve.now/CVE-2024-12020.md): Reflected Cross-Site Scripting (XSS) (CVSS 6.4)
- [CVE-2024-12019](https://cve.now/CVE-2024-12019.md): Arbitrary File Read via Document API (CVSS 7.1)
- [CVE-2024-54449](https://cve.now/CVE-2024-54449.md): Remote Code Execution (RCE) via Arbitrary File Write In Document API (CVSS 8.7)
- [CVE-2024-54448](https://cve.now/CVE-2024-54448.md): Remote Code Execution (RCE) via Automation Scripting (CVSS 8.6)
- [CVE-2024-54447](https://cve.now/CVE-2024-54447.md): Blind SQLi in Saved Search (CVSS 7.1)
- [CVE-2024-54446](https://cve.now/CVE-2024-54446.md): Blind SQLi in Document History (CVSS 7.1)
- [CVE-2024-54445](https://cve.now/CVE-2024-54445.md): Blind SQLi in Login (CVSS 8.7)
- [CVE-2022-47418](https://cve.now/CVE-2022-47418.md): LogicalDOC Document Version Comment Stored XSS (CVSS 5.4)
- [CVE-2022-47417](https://cve.now/CVE-2022-47417.md): LogicalDOC Document File Name Stored XSS (CVSS 5.4)
- [CVE-2022-47416](https://cve.now/CVE-2022-47416.md): LogicalDOC Chat Stored XSS (CVSS 5.4)
- [CVE-2022-47415](https://cve.now/CVE-2022-47415.md): LogicalDOC Messaging Stored XSS (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/logicaldoc
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.