CVE-2025-11946: LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting
A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11946?
CVE-2025-11946 is classified as a high severity vulnerability due to potential unauthorized access risks.
How do I fix CVE-2025-11946?
To fix CVE-2025-11946, upgrade LogicalDOC Community Edition to version 9.2.2 or later, which includes security patches.
What software is affected by CVE-2025-11946?
CVE-2025-11946 affects LogicalDOC Community Edition versions up to and including 9.2.1.
What component is involved in CVE-2025-11946?
CVE-2025-11946 involves a security flaw in the /frontend.jsp component related to the Add Contact Page.
What types of inputs are exploited in CVE-2025-11946?
CVE-2025-11946 can be exploited through manipulation of input fields such as First Name, Last Name, Company, Address, Phone, and Mobile.