CVE-2019-25257

Published: Dec 24, 2025Modified: Jun 17, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

Related CWEs

CWE-426

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (5)

https://www.exploit-db.com/exploits/44021

Source: disclosure@vulncheck.com

https://www.logicaldoc.com

Source: disclosure@vulncheck.com

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/44021

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.