CVE-2025-11410
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the firstname argument leads to SQL injection. The attack can be executed remotely and the exploit is public; other parameters might also be affected.
Risk Assessment
An attacker could execute arbitrary SQL queries, risking leakage, modification, or deletion of voter data. This may undermine the integrity of the voting process.
Recommendation
Implement parameterized queries, restrict access to the admin panel, and patch the vulnerable version as soon as possible.
Other vulnerabilities in Campcodes Advanced Online Voting Management System
See all- CVE-2025-11417Medium
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the photo argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-11409Medium
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0 affecting /index.php. Manipulation of the voter argument results in SQL injection. Remote exploitation is possible and the exploit is now public.
Original NVD description (English source)
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Other parameters might be affected as well.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS