VulnerabilityAnalyzed
CVE-2025-11410
Executing manipulation of the argument firstname can lead to sql injection.
LOW 2.1EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Other parameters might be affected as well.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-89
- Affected
- campcodes/advanced online voting system
- Source
- cna@vuldb.com
References
- https://github.com/hbesljx/vul/issues/3Exploit, Issue Tracking
- https://vuldb.com/?ctiid.327347Permissions Required, VDB Entry
- https://vuldb.com/?id.327347Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.665586Third Party Advisory, VDB Entry
- https://www.campcodes.com/Product
- https://github.com/hbesljx/vul/issues/3Exploit, Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.