CVE-2026-14649
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.
Risk Assessment
The risk involves remote exploitation of SQL injection, potentially leading to unauthorized access, data leakage, or data manipulation within the voting system database.
Recommendation
Immediately update the system to the latest version or apply a security patch that properly sanitizes and parameterizes SQL queries in the /saveVote.php file.
Other vulnerabilities in Online Voting System
See all- CVE-2026-14648High
A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.
- CVE-2025-13287Medium
SQL Injection vulnerability in itsourcecode Online Voting System 1.0. Attack via manipulation of id/category argument in /index.php?page=categories. Attack can be executed remotely, exploit is publicly available.
- CVE-2025-13286Medium
A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_user. Performing manipulation of the argument ID results in SQL injection. Remote exploitation of the attack is possible, and the exploit has been released to the public and may be exploited.
Original NVD description (English source)
A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function test_input of the file /saveVote.php. Performing a manipulation of the argument voterName/voterEmail/voterID/selectedCandidate results in sql injection. The attack can be initiated remotely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS