Is there a public PoC exploit available for CVE-2026-13526?

Yes, a public proof-of-concept exploit is available for CVE-2026-13526. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-13526

Q: What is the CVSS score of CVE-2026-13526?

CVE-2026-13526 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40023 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-6qpr-mpcq-v8g7

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint with no interaction needed; low C/I/A reflects constrained database scope, not full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 02:47 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_class.php endpoint to unauthenticated remote database manipulation via the unsanitized ID parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AC:L), no authentication or user interaction is required to initiate the attack, and a public proof-of-concept exploit is available on GitHub. No vendor patch has been identified at time of analysis, leaving deployments with no vendor-sanctioned remediation path.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*) distributed by SourceCodester, which publishes free open-source web applications typically targeting educational institutions. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the ID parameter in /edit_class.php is passed directly into a SQL query without sanitization, parameterization, or type enforcement. This is a classic PHP/MySQL injection pattern where user-supplied input reaches the query layer unmodified. The CPE wildcard on the version field suggests all available versions share this code path, though version 1.0 is explicitly named in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations running this application should immediately restrict network access to the /edit_class.php endpoint using a web application firewall or perimeter access control rules, limiting requests to trusted internal IP ranges only - note this does not fix the underlying flaw and may not protect against attacks originating from trusted networks. In the PHP source code, the ID parameter should be enforced as an integer type (e.g., intval($_GET['id'])) and all SQL queries should be rewritten to use parameterized prepared statements (PDO or MySQLi), which eliminates the injection surface entirely. If neither mitigation can be applied promptly, the application should be taken offline until a code-level fix is in place. Monitor VulDB entry https://vuldb.com/vuln/374534 for any upstream patch publication.