A vulnerability has been found in SourceCodester Online Voting System 1.0. (CVE-2026-86160)

The vulnerability in SourceCodester Online Voting System 1.0 is a SQL injection flaw located in an unspecified function handling the ID argument in the /ajax.php?action=delete_voting file. This allows remote attackers to manipulate SQL queries by injecting malicious input through the ID parameter. The vulnerability is identified as CWE-74 and has a CVSS 3.1 base score of 7.3, reflecting a moderate impact on confidentiality, integrity, and availability. Although exploit code has been disclosed publicly, there is no evidence of widespread exploitation. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability can lead to unauthorized SQL command execution, potentially compromising the confidentiality, integrity, and availability of the backend database. This may allow attackers to read, modify, or delete data remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and validate or sanitize input parameters to prevent SQL injection.