CVE-2025-11409
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0 affecting /index.php. Manipulation of the voter argument results in SQL injection. Remote exploitation is possible and the exploit is now public.
Risk Assessment
An attacker could gain unauthorized access to the database, potentially leaking or manipulating voter data. This may threaten trust in the entire voting system.
Recommendation
Immediately patch the vulnerability, use parameterized queries, and monitor for unusual database queries.
Other vulnerabilities in Campcodes Advanced Online Voting Management System
See all- CVE-2025-11417Medium
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the photo argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-11410Medium
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the firstname argument leads to SQL injection. The attack can be executed remotely and the exploit is public; other parameters might also be affected.
Original NVD description (English source)
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument voter results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS