CVE-2020-37154 HIGH

CVE-2020-37154: eLection 2.0 - 'id' SQL Injection

Vendor Tripath Project
Product eLection
Weakness CWE-89 · SQLi
Published February 6, 2026
Last update February 17, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.

Key dates

02Disclosure timeline

February 6, 2026 CVE published
February 17, 2026 Record updated