Medium severity · published Oct 31, 2025
CVE-2025-12546
LogicalDOC Community Edition API Key creation UI cross site scripting
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Community Edition · LogicalDOC
9.2.0; 9.2.1 · source: vendor
LO
Logicaldoc · Logicaldoc
through 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12546
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12546
Exploit
https://gist.github.com/thezeekhan/fa0dcfda4f1f915c625d3f89f8ec0529
Permissions Required
https://vuldb.com/?ctiid.330806
Third Party Advisory
https://vuldb.com/?id.330806
Third Party Advisory
https://vuldb.com/?submit.677170
More from Community Edition
8.1
CVE-2025-12547
LogicalDOC Community Edition Admin Login login.jsp excessive authentication
5.4
CVE-2025-11946
LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting