CVE-2025-13287
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SQL Injection vulnerability in itsourcecode Online Voting System 1.0. Attack via manipulation of id/category argument in /index.php?page=categories. Attack can be executed remotely, exploit is publicly available.
Risk Assessment
Risk of unauthorized database access, data leakage, and integrity compromise.
Recommendation
Use parameterized SQL queries or prepared statements. Update to the latest version or apply security patches.
Other vulnerabilities in Online Voting System
See all- CVE-2026-14649High
A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.
- CVE-2026-14648High
A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.
- CVE-2025-13286Medium
A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in SQL injection. Remote exploitation of the attack is possible, and the exploit has been released to the public and may be exploited.
Original NVD description (English source)
A weakness has been identified in itsourcecode Online Voting System 1.0. This affects an unknown function of the file /index.php?page=categories. Executing manipulation of the argument id/category can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS