CVE-2020-37154

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2020

CVE-2020-371557.5Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by sup CVE-2020-371566.5BloodX 1.0 contains an authentication bypass vulnerability in login.php that allows attackers to access the dashboard without valid credenti CVE-2020-371577.5DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credent CVE-2020-371588.8AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the pass CVE-2020-371599.8Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory r CVE-2020-37169.8Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted da CVE-2020-371606.2SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Wind CVE-2020-371619.8Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the re CVE-2020-371629.8Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitr CVE-2020-371638.2QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' pa CVE-2020-371645.5AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversiz CVE-2020-371655.5AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversiz