CVE-2018-25127

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users into visiting a malicious site.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Dec 24, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2018

CVE-2018-251288.2SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries throug CVE-2018-251297.5SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitiv CVE-2018-251306.2Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication creden CVE-2018-251317.2Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload fun CVE-2018-251326.1MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through thre CVE-2018-251334.3Synaccess netBooter NP-0801DU 7.4 contains a cross-site request forgery vulnerability that allows attackers to perform administrative action CVE-2018-251349.8Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticat CVE-2018-251359.8Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious CVE-2018-251367.5FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams withou CVE-2018-251377.5FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download s CVE-2018-251389.8FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. A CVE-2018-251397.5FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without