CVE-2025-11667
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability was found in code-projects Automated Voting System 1.0. An unknown function of the file /admin/add_candidate_modal.php is affected. Manipulation of the firstname argument results in SQL injection. The attack can be executed remotely and the exploit has been made public.
Risk Assessment
An attacker could remotely execute malicious SQL queries, potentially modifying or exposing voting data, undermining system integrity.
Recommendation
Implement input validation and SQL query parameterization fixes; consider taking the system offline from public access until patched.
Other vulnerabilities in Automated Voting System
See all- CVE-2025-12238Medium
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-11668Medium
A vulnerability in code-projects Automated Voting System 1.0. It affects an unknown functionality in /admin/update_user.php, where the Password argument causes SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candidate_modal.php.. The manipulation of the argument firstname results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS