CVE-2020-37154

7.1 highEPSS 0.5%

High (7.1). EPSS 0.5% chance of exploitation in the next 30 days.

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/J3rryBl4nks/eLection-TriPath-/blob/master/SQLiIntoRCE.md
https://sourceforge.net/projects/election-by-tripath/
https://www.exploit-db.com/exploits/48122
https://www.vulncheck.com/advisories/election-id-sql-injection

Check your stack JSON