CVE-2026-14649

HighCVSS 7.3

Published: 04/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.

Risk Assessment

The risk involves remote exploitation of SQL injection, potentially leading to unauthorized access, data leakage, or data manipulation within the voting system database.

Recommendation

Immediately update the system to the latest version or apply a security patch that properly sanitizes and parameterizes SQL queries in the /saveVote.php file.

Other vulnerabilities in Online Voting System

CVE-2026-14648High
A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.

Original NVD description (English source)

A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function test_input of the file /saveVote.php. Performing a manipulation of the argument voterName/voterEmail/voterID/selectedCandidate results in sql injection. The attack can be initiated remotely.