CVE-2026-86290: SourceCodester Online Voting System ajax.php save_category sql injection
A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=savecategory. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. An exposed instance with the affected endpoint reachable over the network is therefore the relevant exposure condition.
Is public exploit code available?
Yes. The available information states that an exploit has been made public and could be used in attacks.
What is the potential impact of successful exploitation?
The provided severity vector indicates low impacts to confidentiality, integrity, and availability. The issue is classified as SQL injection, affecting the Category argument handled by the save_category action in /voting/ajax.php.