CVE-2025-45871: SQL Injection

Q: Who can exploit this issue?

An authenticated user can exploit it. The available information does not indicate that unauthenticated access is sufficient.

Q: What input is used to trigger the injection?

The injection is triggered through a crafted workflow template name handled by the WorkflowsDataServlet component.

Q: Which deployments should be considered affected?

LogicalDOC Enterprise versions up to and including 9.1.1 should be considered affected based on the available information.

Published Oct 6, 2026

Updated

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.

Affected Software

1 affected component

LogicalDoc LogicalDOC Enterprise<=9.1.1

Event History

Oct 6, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·06:16 PM

Description

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit it. The available information does not indicate that unauthenticated access is sufficient.

What input is used to trigger the injection?

The injection is triggered through a crafted workflow template name handled by the WorkflowsDataServlet component.

Which deployments should be considered affected?

LogicalDOC Enterprise versions up to and including 9.1.1 should be considered affected based on the available information.

CVE-2025-45871: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is used to trigger the injection?

Which deployments should be considered affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is used to trigger the injection?

Which deployments should be considered affected?