Voting System
Monthly
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially leading to remote code execution. The vulnerability requires high-privilege credentials (PR:H) to exploit and affects only administrative functions; publicly available exploit code exists but exploitation is limited to admin-authenticated attackers with access to the administrative interface.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/candidates_add.php, potentially enabling remote code execution. The vulnerability requires valid administrative credentials and has been publicly disclosed with exploit code available, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.06% EPSS percentile reflecting low automatable impact and authentication barriers.
SQL injection vulnerability in code-projects Voting System 1.0 allows remote authenticated attackers to manipulate the ID parameter in /admin/positions_edit.php, potentially leading to unauthorized data access or modification. A public exploit is available, but low CVSS score (2.1) and EPSS (0.04%) indicate limited real-world risk, and no active exploitation has been reported.
SQL injection in Code-projects Voting System 1.0 allows remote authenticated attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/positions_row.php. Publicly available exploit code exists, enabling data theft or manipulation.
Authenticated SQL injection in code-projects Voting System 1.0 allows a low-privileged attacker to manipulate the description parameter in the admin panel endpoint /admin/positions_add.php, leading to unauthorized data access or modification. Public exploit code is available, but exploitation probability is very low (EPSS 0.04%) and the vector requires authentication; no active exploitation has been confirmed.
SQL injection in code-projects Voting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/voters_row.php, leading to potential database compromise. Exploit code is publicly available, and no vendor patch exists.
SQL injection in code-projects Voting System 1.0 allows authenticated low-privilege attackers to manipulate the ID parameter in /admin/voters_edit.php, potentially accessing or modifying database contents. A public exploit is available, though exploitation probability is low (EPSS 0.04%) and no active exploitation has been reported.
SQL injection in Voting System 1.0 allows remote attackers with low privileges to manipulate database queries via the firstname and lastname parameters in /admin/voters_add.php. Exploit code is publicly available but the vulnerability has a very low EPSS exploitation probability (0.04%) and no active exploitation has been confirmed by CISA KEV.
A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially leading to remote code execution. The vulnerability requires high-privilege credentials (PR:H) to exploit and affects only administrative functions; publicly available exploit code exists but exploitation is limited to admin-authenticated attackers with access to the administrative interface.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/candidates_add.php, potentially enabling remote code execution. The vulnerability requires valid administrative credentials and has been publicly disclosed with exploit code available, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.06% EPSS percentile reflecting low automatable impact and authentication barriers.
SQL injection vulnerability in code-projects Voting System 1.0 allows remote authenticated attackers to manipulate the ID parameter in /admin/positions_edit.php, potentially leading to unauthorized data access or modification. A public exploit is available, but low CVSS score (2.1) and EPSS (0.04%) indicate limited real-world risk, and no active exploitation has been reported.
SQL injection in Code-projects Voting System 1.0 allows remote authenticated attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/positions_row.php. Publicly available exploit code exists, enabling data theft or manipulation.
Authenticated SQL injection in code-projects Voting System 1.0 allows a low-privileged attacker to manipulate the description parameter in the admin panel endpoint /admin/positions_add.php, leading to unauthorized data access or modification. Public exploit code is available, but exploitation probability is very low (EPSS 0.04%) and the vector requires authentication; no active exploitation has been confirmed.
SQL injection in code-projects Voting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/voters_row.php, leading to potential database compromise. Exploit code is publicly available, and no vendor patch exists.
SQL injection in code-projects Voting System 1.0 allows authenticated low-privilege attackers to manipulate the ID parameter in /admin/voters_edit.php, potentially accessing or modifying database contents. A public exploit is available, though exploitation probability is low (EPSS 0.04%) and no active exploitation has been reported.
SQL injection in Voting System 1.0 allows remote attackers with low privileges to manipulate database queries via the firstname and lastname parameters in /admin/voters_add.php. Exploit code is publicly available but the vulnerability has a very low EPSS exploitation probability (0.04%) and no active exploitation has been confirmed by CISA KEV.
A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.