Which versions of Class and Exam Timetabling System are affected by CVE-2026-11486?

SourceCodester Class and Exam Timetabling System 1.0 contains an unauthenticated SQL injection vulnerability in the archive module that allows remote attackers to directly query the backend database…

Is there a public PoC exploit available for CVE-2026-11486?

Yes, a public proof-of-concept exploit is available for CVE-2026-11486. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-11486?

Within 24 hours: identify and isolate affected instances; disable the /archive1.php endpoint if functionality permits. Within 7 days: contact SourceCodester for patch timeline; implement SQL injection blocking rules via Web Application Firewall targeting the 'sy' parameter in /archive1.php with strict input validation. Within 30 days: evaluate migration timeline to patched version or alternative software; conduct database access audit to determine scope of potential compromise.

Class and Exam Timetabling System CVE-2026-11486

Q: What is the CVSS score of CVE-2026-11486?

CVE-2026-11486 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35017 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-jhwg-f9vr-9mj8

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:16 vuln.today

DescriptionCVE.org

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /archive1.php. Performing a manipulation of the argument sy results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive1.php to inject arbitrary SQL queries against the backend database. Publicly available exploit code exists per VulDB submission 369106, raising the practical risk despite the moderate CVSS 7.3 score. No KEV listing and no public exploitation campaigns identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based academic scheduling web application distributed by SourceCodester, a community repository of small-scale PHP/MySQL projects frequently used in student and small-institution deployments. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the 'sy' GET/POST parameter passed to /archive1.php is concatenated into a SQL query without parameterization or sanitization. The vulnerable CPE is cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:* covering version 1.0, and the backend is presumed to be MySQL based on typical SourceCodester architecture.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester projects typically receive community fixes rather than formal advisories. Operators should immediately review /archive1.php and replace any direct concatenation of the 'sy' parameter into SQL queries with PHP prepared statements (PDO or mysqli with bound parameters), and apply input allowlisting (e.g., constraining 'sy' to an expected academic-year format like YYYY-YYYY). As compensating controls, restrict access to /archive1.php via web-server ACLs or HTTP basic authentication, deploy a WAF rule blocking SQL meta-characters in the 'sy' parameter (trade-off: may break legitimate hyphenated year inputs), or take the application offline if it is not business-critical. Monitor for further details at https://vuldb.com/vuln/369106 and the PoC reference at https://github.com/ssaaaa1234/cve/issues/1.