CVE-2026-86160: SQL Injection in SourceCodester Online Voting System

SourceCodester Online Voting System 1.0 contains a SQL injection vulnerability in an unspecified function within /ajax.php?action=delete_voting. An attacker can manipulate the ID argument to inject SQL code, potentially compromising the backend database. The vulnerability is remotely exploitable without privileges or user interaction. Public exploit details are available, but no known active exploitation in the wild has been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to intermediate impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to read or modify database contents, potentially leading to unauthorized data access or manipulation within the voting system. The medium severity reflects moderate impact on confidentiality, integrity, and availability. No evidence of active exploitation in the wild has been reported.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restricting access to the vulnerable endpoint and implementing web application firewall rules to detect and block SQL injection attempts may reduce risk.