Vulnerabilidades do LogicalDOC Srl LogicalDOC Enterprise
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam LogicalDOC Srl LogicalDOC Enterprise: 2 registro(s), com versões afetadas e correções.
CVE-2019-25258
Alta · 7.5
CWE-22 24/12/2025
LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
CVE-2019-25257
Média · 6.5
CWE-426 24/12/2025
LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation
LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.