LogicalDOC Community vulnerabilities
7 known vulnerabilities in LogicalDOC Community from LogicalDOC. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
LogicalDOC Community: Relative Path Traversal
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate
- 7.2 High severity
LogicalDOC Community: Improper Control of Generation of Code
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed
- 7.1 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presen
- 7.1 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the pr
- 8.7 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or
- 8.7 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence o
- 7.1 High severity
LogicalDOC Community: Relative Path Traversal
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing documen