A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save_category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

A SQL injection vulnerability has been identified in SourceCodester Online Voting System version 1.0. The flaw exists in the file /voting/ajax.php?action=save_category, where manipulation of the 'Category' argument leads to SQL injection. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based voting application distributed by SourceCodester. No authentication details are specified, suggesting the endpoint may be accessible without prior authentication. The vulnerability has been assigned CVE-2026-86290 and is listed in the NVD database. Organizations using this software should apply patches or mitigations immediately given the public availability of the exploit.