CVE-2025-45871
HIGHCVSS 8.1/10EPSS 0.26%
Last modified
CVE-2025-45871 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-45871?
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.
How severe is CVE-2025-45871?
CVE-2025-45871 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 0.26% probability of exploitation in the next 30 days.
How do I fix CVE-2025-45871?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-45866TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to cont…5.4
- CVE-2025-45867TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to cont…5.4
- CVE-2025-45868LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to …8.8
- CVE-2025-45869LogicalDOC Enterprise Version up to and before v9.1.1 is vul…7.3
- CVE-2025-4587The A/B Testing for WordPress plugin for WordPress is vulner…6.4
- CVE-2025-45870LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to …6.5
- CVE-2025-45872zrlog v3.1.5 was discovered to contain a Server-Side Request…9.8
- CVE-2025-45878A cross-site scripting (XSS) vulnerability in the report man…6.1
- CVE-2025-45879A cross-site scripting (XSS) vulnerability in the e-mail man…6.1
- CVE-2025-4588The 360 Photo Spheres plugin for WordPress is vulnerable to …6.4
- CVE-2025-45880A cross-site scripting (XSS) vulnerability in the data resou…6.1
- CVE-2025-45885PHPGURUKUL Vehicle Parking Management System v1.13 is vulner…9.8
Are you affected by CVE-2025-45871?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST