Advanced Online Voting System
Monthly
We need to produce a JSON object with all the fields as specified. Use all the data from the multi-source intelligence. Note the assigned CVSS is CVSS:4.0, not 3.1. There's also a CVSS score 5.5 but it's 4.0 vector. We must synthesize, not just paraphrase. The description: Campcodes Advanced Online Voting Management System 1.0, file /admin/login.php, unknown function, username argument leads to SQL injection, remote, exploit disclosed. We have EPSS 0.03%, low. POC publicly available. No KEV mentioned. CPE: campcodes:advanced_online_voting_system:1.0. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') but likely SQL injection is CWE-89; they gave CWE-74 which is a parent. Could mention that. The references: GitHub with exploit (vul/issues/5), vuldb links, campcodes.com. CVSS:4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So unauthenticated, network, low complexity, no user interaction, low impact on all three (Confidentiality, Integrity, Availability), but scope is none so only vulnerable system. Exploit maturity is Proof-of-Concept (E:P). So overall base score 5.5, which is medium. The 4.0 score is 5.5 (Base). In our assessed CVSS vectors, we'll need to give both 3.1 and 4.0. We must not just copy; we need to provide our own independent assessment grounded in description. Since the description is a typical SQLi with username parameter, remote, unauthenticated (likely /admin/login.php is login page, so no authentication required to send request), low complexity, but impact? SQL injection can lead to data leakage (confidentiality), maybe data modification (integrity) but might be limited. Possibly could lead to admin access depending on SQL. The CVSS 4.0 they gave says low impact on C/I/A, no scope change. That's plausible for a login page SQLi where you can bypass authentication and maybe extract data. I'd assess similar: CVSS 3.1: maybe AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's ba
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/voters_add.php, leading to limited confidentiality and integrity impact. The vulnerability requires valid user credentials (PR:L) and has a publicly available exploit, but EPSS scoring (0.03%, percentile 8%) suggests low real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Advanced Online Voting Management System 1.0 allows authenticated remote attackers to manipulate the voter parameter in /index.php, potentially leading to unauthorized data access or modification. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited confidentiality impact, but publicly available exploit code exists and exploitation probability is rated at 8th percentile by EPSS, suggesting this remains a lower-priority issue despite public POC availability.
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Advanced Online Voting System 1.0 and classified as problematic. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0 and classified as critical. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
We need to produce a JSON object with all the fields as specified. Use all the data from the multi-source intelligence. Note the assigned CVSS is CVSS:4.0, not 3.1. There's also a CVSS score 5.5 but it's 4.0 vector. We must synthesize, not just paraphrase. The description: Campcodes Advanced Online Voting Management System 1.0, file /admin/login.php, unknown function, username argument leads to SQL injection, remote, exploit disclosed. We have EPSS 0.03%, low. POC publicly available. No KEV mentioned. CPE: campcodes:advanced_online_voting_system:1.0. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') but likely SQL injection is CWE-89; they gave CWE-74 which is a parent. Could mention that. The references: GitHub with exploit (vul/issues/5), vuldb links, campcodes.com. CVSS:4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So unauthenticated, network, low complexity, no user interaction, low impact on all three (Confidentiality, Integrity, Availability), but scope is none so only vulnerable system. Exploit maturity is Proof-of-Concept (E:P). So overall base score 5.5, which is medium. The 4.0 score is 5.5 (Base). In our assessed CVSS vectors, we'll need to give both 3.1 and 4.0. We must not just copy; we need to provide our own independent assessment grounded in description. Since the description is a typical SQLi with username parameter, remote, unauthenticated (likely /admin/login.php is login page, so no authentication required to send request), low complexity, but impact? SQL injection can lead to data leakage (confidentiality), maybe data modification (integrity) but might be limited. Possibly could lead to admin access depending on SQL. The CVSS 4.0 they gave says low impact on C/I/A, no scope change. That's plausible for a login page SQLi where you can bypass authentication and maybe extract data. I'd assess similar: CVSS 3.1: maybe AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's ba
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/voters_add.php, leading to limited confidentiality and integrity impact. The vulnerability requires valid user credentials (PR:L) and has a publicly available exploit, but EPSS scoring (0.03%, percentile 8%) suggests low real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Advanced Online Voting Management System 1.0 allows authenticated remote attackers to manipulate the voter parameter in /index.php, potentially leading to unauthorized data access or modification. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited confidentiality impact, but publicly available exploit code exists and exploitation probability is rated at 8th percentile by EPSS, suggesting this remains a lower-priority issue despite public POC availability.
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Advanced Online Voting System 1.0 and classified as problematic. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Advanced Online Voting System 1.0 and classified as critical. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.