CVE-2025-11668
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in code-projects Automated Voting System 1.0. It affects an unknown functionality in /admin/update_user.php, where the Password argument causes SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes potential database manipulation, leading to unauthorized data access, integrity compromise, or privilege escalation.
Recommendation
Update the system immediately and use prepared statements or parameterized queries to prevent SQL injection.
Other vulnerabilities in Automated Voting System
See all- CVE-2025-12238Medium
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-11667Medium
A vulnerability was found in code-projects Automated Voting System 1.0. An unknown function of the file /admin/add_candidate_modal.php is affected. Manipulation of the firstname argument results in SQL injection. The attack can be executed remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_user.php. This manipulation of the argument Password causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS