Is there a public PoC exploit available for CVE-2026-13486?

Yes, a public proof-of-concept exploit is available for CVE-2026-13486. Prioritise patching immediately. EPSS: 0.4%.

Timetabling System CVE-2026-13486

Q: What is the CVSS score of CVE-2026-13486?

CVE-2026-13486 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-39986 MEDIUM

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-v27j-7ppq-v4p8

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no user interaction; C/I/A set to Low reflecting database-scope impact without inherent code execution or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 10:35 vuln.today

CVSS changed

Jun 28, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Executing a manipulation of the argument course_year_section can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the course_year_section parameter on the /preview6.php endpoint, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, and a public proof-of-concept has been disclosed on GitHub. While not listed in CISA KEV, the trivially low attack complexity combined with POC availability raises the realistic exploitation risk above what the 5.5 medium score alone implies.

Technical ContextAI

The affected application is a PHP-based academic scheduling system distributed by SourceCodester, a vendor known for open-source educational and demo PHP applications. The vulnerable file /preview6.php accepts a course_year_section GET or POST parameter that is directly interpolated into a backend SQL query without sanitization or parameterization, constituting a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command - SQL Injection) flaw. The CPE string cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all tracked versions are potentially affected. The underlying database engine is not specified in the available data but is consistent with the MySQL/MariaDB stacks typical of SourceCodester PHP projects.

RemediationAI

No vendor-released patch has been identified at time of analysis. The most effective immediate control is to restrict network access to any deployed instance of this application, particularly blocking public internet access to the /preview6.php endpoint via firewall rules or web server access controls - this has no functional trade-off for internal-only deployments. A WAF rule blocking SQL metacharacters (single quotes, SQL keywords such as UNION/SELECT/OR) in the course_year_section parameter can serve as a compensating control for internet-facing deployments, though overly aggressive filtering may break legitimate course section identifiers. Developers should remediate the root cause by replacing direct string interpolation in the SQL query with PDO or MySQLi prepared statements and bound parameters in /preview6.php. If the application cannot be immediately patched or taken offline, consider restricting access to authenticated sessions via an upstream reverse proxy requiring HTTP Basic Auth. See https://vuldb.com/vuln/374483 and https://github.com/lffaker/cybersec/issues/5 for technical details.