Which versions of Class and Exam Timetabling System are affected by CVE-2026-11485?

SourceCodester Class and Exam Timetabling System 1.0 contains a publicly exploitable SQL injection vulnerability requiring no authentication, enabling attackers to directly access or modify student…

Is there a public PoC exploit available for CVE-2026-11485?

Yes, a public proof-of-concept exploit is available for CVE-2026-11485. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11485?

Within 24 hours: Audit all systems running SourceCodester Class and Exam Timetabling System version 1.0; restrict network access to /archive2.php via firewall/WAF rules blocking any requests to that endpoint. Within 7 days: Deploy WAF rules to filter SQL injection patterns in the 'sy' parameter; enable database query logging and alerting for anomalous activity; review access logs for exploitation signs. Within 30 days: Contact SourceCodester for patch availability or end-of-life guidance; if no patch released, evaluate replacement with supported timetabling software; conduct forensic review of database access history.

Class and Exam Timetabling System CVE-2026-11485

Q: What is the CVSS score of CVE-2026-11485?

CVE-2026-11485 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35016 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-jxmr-f92j-5cmj

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:16 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php. Such manipulation of the argument sy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive2.php to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (disclosed via GitHub), though there is no confirmed active exploitation in CISA KEV. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial impact across confidentiality, integrity, and availability.

Technical ContextAI

The affected product (cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*) is a PHP-based academic scheduling web application distributed by SourceCodester, a site known for free open-source PHP/MySQL learning projects that frequently lack input sanitization. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'sy' GET/POST parameter passed to /archive2.php is concatenated into a SQL query without parameterized queries or prepared statements, allowing the underlying MySQL/MariaDB interpreter to treat injected SQL syntax as executable. This class of flaw is endemic to SourceCodester's catalog of demonstration applications.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester typically does not issue security advisories or patched releases for its sample projects. Operators should refactor /archive2.php to use PDO or mysqli prepared statements with bound parameters for the 'sy' input (and audit sibling files for the same antipattern), and enforce strict server-side input validation (whitelisting expected school-year formats such as '/^\d{4}-\d{4}$/'). As compensating controls, place the application behind a WAF with SQLi signature rules (trade-off: may break legitimate queries containing reserved keywords), restrict access to the /archive2.php endpoint to authenticated administrators via .htaccess or application-level ACLs (trade-off: breaks any anonymous archive viewing), and ensure the database user backing the app has least-privilege grants so injection cannot escalate to DROP/CREATE or file write via INTO OUTFILE. Reference VulDB entry https://vuldb.com/vuln/369105 for additional advisory detail.