CVE-2018-25412 CRITICAL

CVE-2018-25412: Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php

Vendor Deltasql
Product Delta Sql
Weakness CWE-306 · Missing auth
Published May 30, 2026
Last update June 2, 2026

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

Description

Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.

Key dates

Disclosure timeline

May 30, 2026 CVE published
June 2, 2026 Record updated