Online Voting System CVE-2026-86160

No special conditions are required for exploitation. The vulnerable endpoint is accessible remotely over HTTP with no authentication (PR:N confirmed by CVSS vector), no prior account registration, and no special client state. The only requirement is network reachability to the web server hosting the application. Exploitation is limited in practice by the niche deployment footprint of SourceCodester applications - they are rarely internet-exposed in enterprise environments - and by the bounded impact scope (only the application's own database is affected; no scope change to other systems). The CVSS 4.0 E:P modifier confirms a working public exploit is available, reducing the skill threshold further.

The CVSS 4.0 score of 6.9 reflects moderate impact per component (VC:L/VI:L/VA:L) but no scope change to subsequent systems, which is consistent with a bounded single-database application. The E:P modifier confirms a public exploit exists. There is no CISA KEV listing, so no confirmed active exploitation campaign has been observed. Real-world risk depends heavily on deployment context: SourceCodester applications are predominantly used in student projects, municipal demonstrations, or small institutional settings - even a mid-sized municipal IT team in gniezno should treat this as urgent if they have deployed this application for any live voting function, since the integrity of election data is a high-consequence target regardless of scale. EPSS data is not provided; given the niche product footprint, widespread automated exploitation is unlikely, but the trivial exploitation conditions (no auth, no complexity) make opportunistic scanning plausible once the PoC circulates.

An unauthenticated attacker sends a crafted HTTP POST or GET request to /ajax.php?action=delete_voting with a malicious payload in the ID parameter - for example, a UNION SELECT statement or a tautological condition such as 1 OR 1=1. The database executes the manipulated query, allowing the attacker to extract voter records, credentials, or other sensitive data stored in the database, or to delete all voting entries. The public PoC on GitHub (https://github.com/lwcc223/CVE/issues/2) demonstrates this technique and lowers the skill barrier to exploitation.