CVE-2025-12238
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to user data, including passwords, and to modify database records.
Recommendation
Use parameterized SQL queries and input validation in /admin/user.php to eliminate SQL injection risk.
Other vulnerabilities in Automated Voting System
See all- CVE-2025-11668Medium
A vulnerability in code-projects Automated Voting System 1.0. It affects an unknown functionality in /admin/update_user.php, where the Password argument causes SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11667Medium
A vulnerability was found in code-projects Automated Voting System 1.0. An unknown function of the file /admin/add_candidate_modal.php is affected. Manipulation of the firstname argument results in SQL injection. The attack can be executed remotely and the exploit has been made public.
Original NVD description (English source)
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS