BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

LogicalDOC

CVE-2026-109170: LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries v

CVE-2026-109170 Oct 12, 2026 Source: Vendor

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-109170
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
Showing 1–1 of 1
CVE-2026-109170 BR2026-0000-026679 unclaimed
Credited as ikram-4