CVE-2018-25128: Soca Technology Co., Ltd Soca Access Control System

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by exploiting injection flaws in Login.php and Card_Edit_GetJson.php.

Affected products

• Soca Technology Co., Ltd Soca Access Control System: version 180612 only; version 170000 only; version 141007 only

Published 2025-12-24. Last modified 2026-06-17.