Online Voting System
Monthly
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.