CVE-2026-86290
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A weakness has been identified in SourceCodester Online Voting System 1.0 affecting an unknown function of the file /voting/ajax.php?action=save_category. Manipulation of the argument Category causes SQL injection. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
Risk of unauthorized database access, potentially including reading, modifying, or deleting voting system data.
Recommendation
Apply patches or mitigations immediately to prevent SQL injection, such as using parameterized queries and input validation.
Other vulnerabilities in SourceCodester Online Voting System
See all- CVE-2026-86162High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.
- CVE-2026-86161High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_category. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86160High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_voting. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-86159High
A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=save_user. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS