CVE-2018-25149

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a specially crafted page.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 24, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-251505.3Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user acCVE-2018-251514.3Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administratCVE-2018-251525.3Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts wiCVE-2018-251549.8GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruptionCVE-2018-251554.3Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without prCVE-2018-251564.3Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without propCVE-2018-251576.4Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crCVE-2018-251588.8Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through tCVE-2018-251599.8Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthentiCVE-2018-251606.5HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other imCVE-2018-251618.2Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injectingCVE-2018-251626.52-Plan Team 1.0.4 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload executable PHP files by send
CVE-2018-25149: Medium severity, CVSS 6.5 | Vulnix