Is there a public PoC exploit available for CVE-2026-11471?

Yes, a public proof-of-concept exploit is available for CVE-2026-11471. Prioritise patching immediately. EPSS: 0.0%.

Timetabling System CVE-2026-11471

Q: What is the CVSS score of CVE-2026-11471?

CVE-2026-11471 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35002 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-rphr-w9mf-j735

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 01:26 vuln.today

Severity Changed

Jun 08, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 01:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The manipulation of the argument Password results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

Unauthenticated remote SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index2.php to arbitrary query manipulation via the Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack complexity, making this trivially reachable from the network. Publicly available exploit code exists (POC confirmed via GitHub), though no CISA KEV listing has been issued, meaning widespread active exploitation is not confirmed at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic scheduling application, SourceCodester Class and Exam Timetabling System 1.0 (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*), distributed via sourcecodester.com as an open-source/demo codebase. The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands): the Password field submitted to /index2.php is passed directly into a backend SQL query without parameterization, prepared statements, or adequate escaping - a classic PHP string-concatenation SQLi pattern. The wildcard CPE version string indicates NVD has not scoped the fix to a specific upstream release, suggesting all known versions of 1.0 carry the flaw.

RemediationAI

No vendor-released patch has been identified at time of analysis - the affected version CPE uses a wildcard, confirming no fixed version is scoped. Administrators should monitor https://www.sourcecodester.com/ for an updated release and apply it immediately upon availability. As an immediate compensating control, restrict access to /index2.php using IP allowlisting at the web server (e.g., Apache Allow/Deny directives or nginx geo module) or upstream firewall - note this blocks all remote login access, not selectively attacker traffic. Deploying a Web Application Firewall rule to reject SQL metacharacters (single quotes, comment sequences, UNION keywords) in the Password parameter is a secondary mitigation, though this may cause false positives for legitimate passwords containing special characters. For developers with access to the source, the definitive fix is refactoring /index2.php to use PHP PDO prepared statements with bound parameters, eliminating the string-concatenation pattern entirely. The VulDB advisory is at https://vuldb.com/vuln/369091 and the public POC is documented at https://github.com/Icecream102/cve/issues/4.