Is there a public PoC exploit available for CVE-2026-13521?

Yes, a public proof-of-concept exploit is available for CVE-2026-13521. Prioritise patching immediately. EPSS: 0.3%.

Class and Exam Timetabling System CVE-2026-13521

Q: What is the CVSS score of CVE-2026-13521?

CVE-2026-13521 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40018 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-v4wv-mxfx-4g64

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible endpoint, no auth required (PR:N), trivial exploitation; impact limited to application database yielding low C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 02:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 01:42 vuln.today

DescriptionCVE.org

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the file /preview5.php. Such manipulation of the argument course_year_section leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate database queries via the course_year_section parameter in /preview5.php. The input is passed directly into SQL queries without sanitization (CWE-89), enabling data extraction, modification, or availability disruption. A public proof-of-concept exploit is available on GitHub, and no patch has been identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic scheduling application distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic failure to parameterize or sanitize user-supplied input before it is interpolated into a SQL query. The specific entry point is the course_year_section GET or POST parameter passed to the /preview5.php endpoint, where it is incorporated into a database query without validation. This class of vulnerability typically permits UNION-based, error-based, or blind time-based SQL injection depending on the database backend (likely MySQL given the PHP/SourceCodester stack).

RemediationAI

No vendor-released patch has been identified at time of analysis. Since SourceCodester publishes educational PHP scripts with no formal patch lifecycle, a code-level fix is the only reliable remediation: parameterize all SQL queries in /preview5.php using prepared statements (PDO or MySQLi with bound parameters), and apply input validation to the course_year_section parameter to reject unexpected characters. As an immediate compensating control, administrators should restrict access to /preview5.php at the web server level (e.g., via .htaccess or nginx location block) to authenticated sessions only, or take the endpoint offline if not actively required. A Web Application Firewall (WAF) rule blocking common SQL injection patterns in the course_year_section parameter can reduce exposure but is bypassable and should not be treated as a permanent fix. The public PoC is tracked at https://github.com/xiaoxuxu233/myCVE/issues/2 and the VulDB advisory at https://vuldb.com/vuln/374529.