CVE-2025-45868: SQL Injection
Published Jul 16, 2026
·Updated
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.
Affected Software
1 affected component
LogicalDoc LogicalDOC Enterprise<=9.1.1
Event History
Jul 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user can exploit the blind SQL injection by submitting crafted input to the ComparisonServlet component. The CVSS vector indicates that no user interaction is required.
2
Which deployments are affected?
LogicalDOC Enterprise versions up to and including 9.1.1 are identified as affected. The provided data does not state whether any particular default configuration changes exposure.
3
What is the potential impact of successful exploitation?
Successful exploitation can allow an authenticated attacker to manipulate SQL queries. The assigned CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.