PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14649 Code-Projects CVE debrief

A SQL injection vulnerability was detected in Code-Projects Online Voting System 1.0. The impacted function is test_input in the file /saveVote.php. Performing a manipulation of the argument voterName/voterEmail/voterID/selectedCandidate results in SQL injection. The attack can be initiated remotely. This vulnerability has a CVSS score of 6.9 and a severity of MEDIUM.

Vendor
Code-Projects
Product
Online Voting System 1.0
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-04
Original CVE updated
2026-07-04
Advisory published
2026-07-04
Advisory updated
2026-07-04

Who should care

Security teams and administrators responsible for Code-Projects Online Voting System 1.0 should prioritize patching this vulnerability to prevent potential SQL injection attacks. Additionally, developers and security researchers interested in web application security and SQL injection vulnerabilities should take note of this CVE.

Technical summary

The vulnerability is caused by improper input validation in the /saveVote.php file, specifically in the test_input function. An attacker can exploit this vulnerability by manipulating the voterName, voterEmail, voterID, and selectedCandidate arguments, allowing for SQL injection attacks. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Patching this vulnerability is of medium priority due to its CVSS score of 6.9 and potential for remote exploitation. Security teams should prioritize patching this vulnerability to prevent potential SQL injection attacks.

Recommended defensive actions

  • Patch the vulnerability by applying the latest security updates to Code-Projects Online Voting System 1.0.
  • Conduct a thorough review of the /saveVote.php file and test_input function to ensure proper input validation and sanitization.
  • Implement additional security measures, such as web application firewalls and intrusion detection systems, to detect and prevent SQL injection attacks.
  • Perform regular security audits and vulnerability assessments to identify and address potential security issues.
  • Consider implementing a bug bounty program to encourage responsible disclosure of vulnerabilities.

Evidence notes

The CVE-2026-14649 vulnerability was detected in Code-Projects Online Voting System 1.0. The vulnerability is caused by improper input validation in the /saveVote.php file, specifically in the test_input function. The CVSS score for this vulnerability is 6.9, and the severity is MEDIUM. The attack can be initiated remotely.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14649 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14649

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14649 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14649

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.