What is the CVSS score of CVE-2026-86161?

CVE-2026-86161 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-86161?

Yes, a public proof-of-concept exploit is available for CVE-2026-86161. Prioritise patching immediately. EPSS: 0.3%.

Online Voting System CVE-2026-86161

EUVD-2026-72045 MEDIUM

SQL Injection (CWE-89)

2026-09-06 VulDB

GHSA-45vp-4854-43r7

PHP SQLi Online Voting System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request to /ajax.php
Delivery

Inject malicious SQL via id parameter
Exploit

Bypass query logic in delete_category handler
Execution

Extract or manipulate database records
Impact

Access admin credentials or alter vote data

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of SourceCodester Online Voting System 1.0. The CVSS PR:N metric confirms no authentication is required to reach the vulnerable `/ajax.php?action=delete_category` endpoint. No non-default configuration, specific platform version, or user interaction is needed beyond the application being network-accessible. Exploitation is limited by the product's narrow deployment footprint (primarily academic/demo environments) and by the fact that the injection point is tied to a specific AJAX action (delete_category), which may constrain the range of injectable queries depending on the surrounding PHP logic.
Impact	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P) scores 6.9, reflecting limited per-component CIA impacts. The PR:N metric confirms the endpoint is unauthenticated, and AC:L/AT:N means exploitation requires no special conditions beyond network access - effectively a trivially exploitable attack against any internet-exposed instance. The VC:L/VI:L/VA:L ratings may understate impact: SQL injection in a voting system database could yield extraction of the full schema, admin password hashes, and manipulation of vote records, which arguably warrants C:H/I:H rather than L/L/L in a worst-case SQLi scenario. However, the reporter's limited-impact assessment may reflect that the `delete_category` action itself constrains the injection's reach or that no stacked-query execution was confirmed. The public POC (GitHub, lwcc223/CVE issue #3) lowers the skill barrier for exploitation. No CISA KEV listing found; EPSS data not provided. Real-world risk is further reduced by the product's extremely limited production footprint - SourceCodester applications are predominantly used in academic settings, not production infrastructure.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted HTTP GET or POST request to the target server at `/ajax.php?action=delete_category&id=1+UNION+SELECT+username,password,3+FROM+admin--`, injecting a UNION-based payload that appends admin credential data to the query's result set. Because no session authentication is enforced on the endpoint (PR:N), no prior access is needed. A public proof-of-concept documenting this exact technique is available on GitHub (lwcc223/CVE issue #3), meaning the attack can be replicated with minimal skill.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 06, 2026

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized id parameter in /ajax.php?action=delete_category. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester does not maintain formal security advisories for its educational codebases. For operators who have deployed this application, the primary remediation is to replace raw SQL string concatenation with PHP PDO prepared statements or MySQLi parameterized queries for all user-supplied inputs including the id parameter in /ajax.php. As an immediate compensating control, restrict access to /ajax.php endpoints to authenticated sessions by enforcing session validation at the top of the file - if the delete_category action should require admin privileges, add a strict session/role check before processing the id parameter. Additionally, apply a web application firewall rule to detect and block common SQL injection patterns (UNION, OR 1=1, comment sequences) on this endpoint. Given the educational nature of the product, the most practical recommendation is to not deploy this application in any internet-accessible or production environment.

Affected VersionsENISA

Online Voting System 1.0

Affected Packages

euvd online_voting_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected product is a PHP-based web voting application distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:online_voting_system:*:*:*:*:*:*:*:*), a platform offering free source-code projects primarily targeting developers and students. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The AJAX handler at /ajax.php?action=delete_category accepts an id parameter and passes it unsanitized to a backend SQL query, a classic first-order SQL injection pattern common in educational PHP codebases that do not use prepared statements or PDO parameter binding. The injection point is in an administrative data-manipulation action (category deletion), which may or may not require authentication depending on how session checks are implemented - the CVSS PR:N suggests no authentication is enforced on this endpoint.

Know when Online Voting System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 7.3 HIGH

Network-reachable, no auth (PR:N per CVSS), trivial to exploit; C/I/A limited to L consistent with reporter's VC/VI/VA:L assessment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Sep 06, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Sep 06, 2026 - 02:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Rare

educational hobby project, negligible production footprint

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.