CVE-2026-86160
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_voting. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker could delete or modify voting data, potentially affecting the integrity of election results.
Recommendation
Apply patches immediately and adopt secure coding practices such as parameterized queries.
Other vulnerabilities in SourceCodester Online Voting System
See all- CVE-2026-86290High
A weakness has been identified in SourceCodester Online Voting System 1.0 affecting an unknown function of the file /voting/ajax.php?action=save_category. Manipulation of the argument Category causes SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-86162High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.
- CVE-2026-86161High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_category. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86159High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=save_user. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS