CVE-2025-45871CWE-89sql-injection

CVE-2025-45871

High · published October 6, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-06T22:16Z
References (2)
https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2025-45871 · [email protected]https://www.logicaldoc.com/ · [email protected]
EPSS history
Timeline
  • 08 OCT 03:25Z
    EPSS moved — → 0%
    epss
  • 06 OCT 00:00Z
    LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate…
    cvelistv5