EUVD-2026-97448

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169

LogicalDOC Community Edition versions through 9.3 are vulnerable to a SQL Injection flaw in the TagsDataServlet component. The issue exists in the firstLetter parameter, which fails to properly neutralize input, allowing authenticated users to execute crafted SQL commands. Low-privileged attacker...