CVE-2026-86159: SQL Injection in SourceCodester Online Voting System

SourceCodester Online Voting System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=save_user endpoint. An attacker can manipulate the ID parameter to inject SQL commands, potentially compromising the database. The vulnerability is remotely exploitable without any privileges or user interaction. Exploit code is publicly available, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality, integrity, and availability impacts, and no scope change.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion depending on the database permissions. The impact is rated medium based on the CVSS score of 6.9. There is no indication of active exploitation in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to apply input validation and parameterized queries on the affected endpoint to prevent SQL injection. Monitor vendor channels for updates and apply official patches once released.