Login Request a demo
High severity · published Mar 6, 2026
CVE-2018-25189
Data Center Audit 2.6.2 SQL Injection via username Parameter
8.2
CVSS
0.2%
EPSS
No
On KEV
Description
Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive database information including usernames, database names, and version details.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Data Center Audit · Sourceforge
2.6.2 · source: vendor
Affected product
DC
Data Center Audit
Sourceforge
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25189
www.exploit-db.com
https://www.exploit-db.com/exploits/45807
www.vulncheck.com
https://www.vulncheck.com/advisories/data-center-audit-sql-injection-via-username-parameter
More from Data Center Audit
5.3
CVE-2018-25177
Data Center Audit 2.6.2 Cross-Site Request Forgery via dca_resetpw.php