CVE-2026-86162: SQL Injection in SourceCodester Online Voting System

SourceCodester Online Voting System 1.0 contains a SQL injection vulnerability in the /ajax.php?action=login file. An attacker can remotely exploit this by manipulating the Username argument, potentially allowing unauthorized database queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely via the Username parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts targeting the Username parameter.