Is there a public PoC exploit available for CVE-2026-11472?

Yes, a public proof-of-concept exploit is available for CVE-2026-11472. Prioritise patching immediately. EPSS: 0.0%.

Class Timetabling System CVE-2026-11472

Q: What is the CVSS score of CVE-2026-11472?

CVE-2026-11472 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35003 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-jcg5-pqm8-frvj

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 01:27 vuln.today

Severity Changed

Jun 08, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 01:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipulation of the argument Password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index1.php to unauthenticated remote exploitation via an unsanitized Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier indicates a publicly available proof-of-concept - confirmed via a GitHub issue disclosure. An attacker can manipulate the Password argument to inject arbitrary SQL, potentially bypassing authentication or exfiltrating database contents. No CISA KEV listing is present, and no vendor patch has been identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application developed by SourceCodester, identified via CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input - specifically the Password field submitted to /index1.php - is concatenated directly into a backend SQL query without parameterization or adequate sanitization. This is a classic PHP/MySQL anti-pattern where dynamic query construction with raw POST/GET values allows an attacker to alter query logic. The login form context suggests the SQL query is likely a credential-lookup statement, making authentication bypass a primary exploitation path.

RemediationAI

No vendor-released patch has been identified at time of analysis; the SourceCodester project page (https://www.sourcecodester.com/) should be monitored for updates. The authoritative fix is to rewrite the SQL query in /index1.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), eliminating the injection surface entirely. As compensating controls where source modification is not immediately feasible: deploy a web application firewall (WAF) rule to detect and block common SQL injection patterns in POST body parameters - note this introduces false-positive risk for legitimate inputs containing SQL-like syntax. Restrict network access to /index1.php to trusted IP ranges or internal networks only, accepting that this limits external user access. Implement database-level least privilege so the application's DB account cannot access tables beyond its operational scope, reducing the blast radius of a successful injection. Full remediation requires source code changes; network controls alone are not sufficient given the public PoC.