How severe is CVE-2025-12547?

CVE-2025-12547 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-12547 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-12547?

CVE-2025-12547 affects Logicaldoc. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-12547?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-12547 have an EU (EUVD) identifier?

Yes. CVE-2025-12547 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-37396.

When was CVE-2025-12547 published?

CVE-2025-12547 was published on 2025-10-31 and last updated on 2026-06-17.

CVE-2025-12547

CVE-2025-12547 is a low-severity vulnerability in Logicaldoc with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-307.

Key facts

Severity: Low (CVSS 3.x base score 3.7)
CVSS v2: 2.6
CVSS v4: 2.9
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-37396
Weakness: CWE-307
Affected product: Logicaldoc
Published: 2025-10-31
Last modified: 2026-06-17

Description

A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Frequently asked questions

What is CVE-2025-12547?: A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
How severe is CVE-2025-12547?: CVE-2025-12547 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2025-12547 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-12547?: CVE-2025-12547 affects Logicaldoc. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-12547?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-12547 have an EU (EUVD) identifier?: Yes. CVE-2025-12547 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-37396.
When was CVE-2025-12547 published?: CVE-2025-12547 was published on 2025-10-31 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:*

More vulnerabilities in Logicaldoc

CVE-2020-9423 — Critical (CVSS 9.8): LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of…
CVE-2024-54449 — High (CVSS 8.8): The API used to interact with documents in the application contains two endpoints with a flaw that allows an…
CVE-2017-1000022 — High (CVSS 8.8): LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege…
CVE-2017-1000021 — High (CVSS 8.8): LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
CVE-2020-13542 — High (CVSS 7.8): A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation.…
CVE-2019-25258 — High (CVSS 7.5): LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers…

All CVEs affecting Logicaldoc →

Other CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities

CVE-2026-6853 — Critical (CVSS 9.8): Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses…
CVE-2026-8760 — Critical (CVSS 9.8): The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
CVE-2020-37228 — Critical (CVSS 9.8): iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass…
CVE-2026-33879 — Critical (CVSS 9.8): Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and…
CVE-2026-33640 — Critical (CVSS 9.8): Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users…
CVE-2026-31851 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout…

Browse all CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities →