CVE Intelligence
Analysis AI-assisted

CVE-2025-11422: Campcodes Advanced Online Voting Management System SQL injection in admin login.php

A SQL injection flaw in the Username argument of /admin/login.php in Campcodes Advanced Online Voting Management System 1.0 can be triggered remotely. NVD rates it 9.8 critical under CVSS 3.1, while VulDB scores in the record vary. The exploit is publicly disclosed, but the record does not show KEV listing or confirmed exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-11422 describes an SQL injection weakness in the administrative login page /admin/login.php of Campcodes Advanced Online Voting Management System 1.0. According to the record, the flaw is reached through the Username argument and can be exercised remotely. The entry was published by VulDB and analyzed by NVD.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (critical), with high confidentiality, integrity and availability impact in its vector.
  • Other scores in the record differ, including 6.9 and 5.5 under CVSS 4.0 and 7.3 under CVSS 3.1, so perceived severity depends on the source used.
  • The record classifies the weakness as CWE-74 (Injection).
  • SSVC data in the record marks the issue as automatable with partial technical impact.

Affected products and versions

  • Campcodes Advanced Online Voting Management System, version 1.0.
  • Campcodes Advanced Online Voting System, version 1.0.
  • The record lists no fixed version.

Exploitation status

  • The record states that the exploit has been publicly disclosed and may be used.
  • The CVE is not listed in the CISA KEV catalog according to the record, so active exploitation is not confirmed by that source.
  • SSVC exploitation is recorded at the proof-of-concept level. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no vendor fix. Check the vendor website and contact the vendor for an update or guidance.
  • Until a fix is confirmed, limit access to the administrative interface to trusted networks and users, and avoid exposing it to the public internet.
  • If the application is maintained in-house, use parameterized queries and strict input validation in the login logic.
  • Prioritize this asset for review because of the critical base score.

Detection guidance

  • Review web server and application logs for unusual or malformed input in requests to /admin/login.php.
  • Watch for database error messages and for unexpected administrative logins or account changes.
  • Web application firewall monitoring may help flag injection-style input at a high level, but it is not a substitute for a fix.

Limitations of the available information

  • The record does not identify the exact vulnerable code or the database backend.
  • No vendor advisory or fixed version is included.
  • The EPSS entry in the record is dated 2026-10-13; its currency should be checked against the live feed.
  • The record does not reconcile the differing scores from NVD and VulDB.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog and states that the exploit has been publicly disclosed. No confirmed exploitation in the wild appears in the sources consulted.

Is there a fixed version?

No fixed version is listed in the record. Contact the vendor and restrict access to the admin login until guidance is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.