Logicaldoc
Approved changes feed: RSS · Atom
cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:*part: a version: * update: *
| Vendor | Logicaldoc (99ada430-3eaa-506f-a9ea-0ed1b7c980bc) |
|---|---|
| Product | Logicaldoc (0f5c8c86-f3cf-56d5-bb0a-23477ee51d54) |
| Edition | * |
| Language | * |
| Software edition | community |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109206 |
vulnerable | 2026-11-03 10:17:40.158120 |
LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet
MEDIUM (5.3)
LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.
Published: 2026-10-12T13:39:47.896Z
Updated: 2026-10-13T15:18:15.204Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109203 |
vulnerable | 2026-11-03 10:17:39.940604 |
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
MEDIUM (6.5)
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
Published: 2026-10-12T13:39:45.258Z
Updated: 2026-10-13T18:21:28.374Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109201 |
vulnerable | 2026-11-03 10:17:39.742020 |
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
HIGH (8.3)
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
Published: 2026-10-12T13:39:43.919Z
Updated: 2026-10-13T15:16:41.434Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109204 |
vulnerable | 2026-11-03 10:17:39.383887 |
LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket
MEDIUM (6.3)
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.
Published: 2026-10-12T13:39:45.921Z
Updated: 2026-10-18T12:03:15.988Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109170 |
vulnerable | 2026-11-03 10:17:39.380953 |
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter
MEDIUM (6.5)
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
Published: 2026-10-12T13:39:41.904Z
Updated: 2026-10-13T18:39:39.092Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109199 |
vulnerable | 2026-11-03 10:17:39.371788 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109200 |
vulnerable | 2026-11-03 10:17:39.322800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12547 |
vulnerable | 2026-06-08 07:04:30.420807 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12546 |
vulnerable | 2026-06-08 07:04:30.416112 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11946 |
vulnerable | 2026-06-08 07:04:29.450845 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54449 |
vulnerable | 2026-06-08 06:54:16.559977 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54448 |
vulnerable | 2026-06-08 06:54:16.558164 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9723 |
vulnerable | 2026-06-08 05:14:26.146733 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000023 |
vulnerable | 2026-06-08 05:08:27.127089 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000022 |
vulnerable | 2026-06-08 05:08:27.126788 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000021 |
vulnerable | 2026-06-08 05:08:27.126417 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.