Is there a public PoC exploit available for CVE-2026-13485?

Yes, a public proof-of-concept exploit is available for CVE-2026-13485. Prioritise patching immediately. EPSS: 0.4%.

Timetabling System CVE-2026-13485

Q: What is the CVSS score of CVE-2026-13485?

CVE-2026-13485 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-39985 MEDIUM

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-q3vp-2mqc-929r

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated network vector with no complexity barrier; low C/I/A reflects partial SQL access without full database or system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 10:35 vuln.today

CVSS changed

Jun 28, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a manipulation of the argument course_year_section results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /preview.php endpoint to remote unauthenticated exploitation via the unsanitized course_year_section parameter, allowing arbitrary SQL query execution against the backend database. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier to exploitation. Impact is rated low-to-partial across confidentiality, integrity, and availability, bounded by the database account's privileges, and no vendor patch has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*), a repository of educational and demo-grade web applications. CWE-89 (Improper Neutralization of Special Elements in SQL Commands) identifies the root cause as the direct concatenation of the course_year_section HTTP parameter into a SQL query within /preview.php, with no prepared statements, parameterized queries, or input sanitization applied. The CVSS 4.0 vector confirms no attack complexity barrier (AC:L, AT:N), meaning no race condition, special timing, or target-side configuration is required to trigger the injection. The application is PHP-driven against a likely MySQL backend, which is consistent with the SourceCodester stack pattern.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix requires refactoring /preview.php to replace direct SQL string concatenation with parameterized queries or prepared statements for the course_year_section parameter - this eliminates the injection vector at the code level. As an interim control, deploy a web application firewall rule to detect and block SQL injection payloads targeting this endpoint; note that WAF bypass techniques exist and this is not a substitute for code-level remediation. If the application cannot be patched immediately, restricting access to /preview.php via IP allowlisting or requiring prior authentication reduces the unauthenticated attack surface. Given that SourceCodester applications are demo-grade software not designed for production hardening, organizations running this in live environments should evaluate migration to a maintained alternative. See VulDB at https://vuldb.com/vuln/374482 for additional context.