Is there a public PoC exploit available for CVE-2026-11484?

Yes, a public proof-of-concept exploit is available for CVE-2026-11484. Prioritise patching immediately. EPSS: 0.0%.

Class and Exam Timetabling System CVE-2026-11484

Q: What is the CVSS score of CVE-2026-11484?

CVE-2026-11484 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35015 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-5q5v-x882-qf9g

SQLi PHP Class And Exam Timetabling System

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

MEDIUM 5.5

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:15 vuln.today

DescriptionCVE.org

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive3.php to execute arbitrary database queries. Publicly available exploit code exists, increasing immediate risk to any exposed deployment, though no CISA KEV listing or EPSS data has been provided to indicate widespread active exploitation. The flaw carries a CVSS 7.3 rating reflecting network reachability with no authentication or user interaction required.

Technical ContextAI

The affected product is a PHP-based open-source web application from SourceCodester used in academic environments to manage class and exam scheduling. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'sy' GET/POST parameter passed to /archive3.php is concatenated into a SQL query without parameterization or proper sanitization. The CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:* indicates all versions of the product are within scope as published, and the underlying stack is typical LAMP (PHP + MySQL) as confirmed by the PHP tag.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester projects are typically community-distributed source samples and rarely receive coordinated security releases. Operators should immediately modify /archive3.php to use prepared statements (PDO or mysqli with bound parameters) for the 'sy' argument, and audit other parameters across the codebase for the same pattern since CWE-89 vulnerabilities are usually systemic in this class of application. As compensating controls, restrict access to the application via IP allowlisting or VPN (trade-off: blocks legitimate remote users), deploy a WAF with SQLi rulesets in front of /archive3.php (trade-off: may produce false positives on legitimate scheduling queries), or take the instance offline if it is non-production. Refer to https://vuldb.com/vuln/369104 and the public exploit detail at https://github.com/ssaaaa1234/cve/issues/3 to identify exact payload shapes for WAF rule tuning.