CVE-2025-13286
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in SQL injection. Remote exploitation of the attack is possible, and the exploit has been released to the public and may be exploited.
Risk Assessment
SQL injection may allow an attacker to manipulate user data or votes, undermining the integrity of the voting system and potentially leading to unauthorized changes.
Recommendation
Update the system to a version that fixes the vulnerability, or implement input validation and parameterized queries in /ajax.php?action=save_user.
Other vulnerabilities in Online Voting System
See all- CVE-2026-14649High
A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.
- CVE-2026-14648High
A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.
- CVE-2025-13287Medium
SQL Injection vulnerability in itsourcecode Online Voting System 1.0. Attack via manipulation of id/category argument in /index.php?page=categories. Attack can be executed remotely, exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS