High severity · published Oct 31, 2025
CVE-2025-12547
LogicalDOC Community Edition Admin Login login.jsp excessive authentication
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Community Edition · LogicalDOC
9.2.0; 9.2.1 · source: vendor
LO
Logicaldoc · Logicaldoc
through 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12547
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12547
Exploit
https://gist.github.com/thezeekhan/869aeb01bd981667c35dcac3e72c2bfa
Permissions Required
https://vuldb.com/?ctiid.330807
Third Party Advisory
https://vuldb.com/?id.330807
Third Party Advisory
https://vuldb.com/?submit.677172
More from Community Edition
5.4
CVE-2025-12546
LogicalDOC Community Edition API Key creation UI cross site scripting
5.4
CVE-2025-11946
LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting
