CVE-2018-25412

Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php

Critical9.3EPSS 0.76%

Published: 30 May 2026
Updated: 1 Oct 2026
Reserved: 30 May 2026
Assigned by: VulnCheck

Description

Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form data. Attackers can upload PHP files with arbitrary content to the upload directory and execute them on the server for remote code execution.

Scores

CVSS scores of CVE-2018-25412, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.76% · top 45% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-306: Missing Authentication for Critical Function (opens in a new tab)All about CWE-306 and its CVEs

Affected products

Deltasql · Delta Sql
- affected 1.8.2

References (5)

ExploitDB-45685 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
Product Reference (opens in a new tab)product
VulnCheck Advisory: Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25412](https://trackcve.app/badge/CVE-2018-25412.svg)](https://trackcve.app/cve/CVE-2018-25412)

Record last updated 1 Oct 2026, 15:19 UTC.