What is the CVSS score of CVE-2020-37154?

CVE-2020-37154 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2020-37154?

Yes, a public proof-of-concept exploit is available for CVE-2020-37154. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-37154?

Within 24 hours: Identify all systems running eLection 2.0 and restrict access to the candidate management endpoint to essential personnel only; document current user access logs. Within 7 days: Implement WAF rules to block SQL injection patterns on the affected endpoint and deploy network segmentation to limit lateral movement from compromised accounts. Within 30 days: Evaluate alternative election management solutions, engage the vendor for patch timeline, and conduct forensic audit of candidate management database access logs for signs of exploitation.

CVE-2020-37154

HIGH

SQL Injection (CWE-89)

2026-02-07 disclosure@vulncheck.com

RCE SQLi

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 16:08 vuln.today

Public exploit code

CVE Published

Feb 07, 2026 - 00:15 nvd

HIGH 7.1

DescriptionCVE.org

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the candidate management component of candidate management endpoint. eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Affected ProductsAI

Product: candidate management endpoint. Component: candidate management.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.

CVE-2020-37154 vulnerability details – vuln.today

Back