CVE-2018-25129 HIGH

CVE-2018-25129: SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints

Vendor Soca Technology Co., Ltd
Product SOCA Access Control System
Weakness CWE-639 · IDOR
Published December 24, 2025
Last update December 24, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.

Key dates

02Disclosure timeline

December 24, 2025 CVE published
December 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-8611 Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'invoice_id' Parameter CVE-2024-0872 Watu Quiz <= 3.4.1 - Sensitive Information Disclosure CVE-2022-2198 WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR CVE-2025-14459 Virt-cdi-controller: unauthorized pvc cloning via dataimportcron CVE-2025-2526 Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover