Online Voting System
Monthly
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
A weakness has been identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
A weakness has been identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in itsourcecode Online Voting System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.