OtherCVSS 8.5high
7 min read
Searching for Every Voter With a Single Percent Sign
A search field on a civic technology platform accepted SQL LIKE wildcards without sanitization. Entering a single percent sign returned the entire database — every record, every row, no authentication escalation required. Just one character in a search box.
Read case