Is there a public PoC exploit available for CVE-2026-13527?

Yes, a public proof-of-concept exploit is available for CVE-2026-13527. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-13527

Q: What is the CVSS score of CVE-2026-13527?

CVE-2026-13527 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40024 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-xww8-ghhh-72hv

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no user interaction; impact limited to partial database read/write/disruption with no scope change beyond the vulnerable application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 04:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 04:01 vuln.today

DescriptionCVE.org

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /preview4.php. Such manipulation of the argument course_year_section leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /preview4.php endpoint to unauthenticated remote attackers via the course_year_section parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-prerequisite network exploitation against default deployments, with low-level impact across confidentiality, integrity, and availability of the backend database. No public exploit identified at time of analysis is incorrect here - a public proof-of-concept has been disclosed on GitHub (E:P maturity confirmed), meaningfully lowering the barrier for opportunistic and automated attacks against academic institutions running this software.

Technical ContextAI

The vulnerable component is a PHP-based academic scheduling web application developed by SourceCodester, identified by CPE as cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 - Improper Neutralization of Special Elements Used in an SQL Command - meaning the course_year_section parameter accepted by /preview4.php is concatenated directly into a backend SQL query without parameterization or sanitization. PHP applications using raw mysqli_query() or similar non-prepared-statement calls are archetypal examples of this weakness. An attacker can inject SQL metacharacters and clauses (e.g., UNION SELECT, boolean-based blind payloads) to manipulate query logic and interact with the underlying database engine outside of intended application boundaries.

RemediationAI

No vendor-released patch has been identified at the time of analysis; no formal security update from SourceCodester appears in the referenced advisories. For immediate compensating controls, restrict public access to /preview4.php via web server configuration - for example, an nginx location /preview4.php { deny all; } block or Apache <Files preview4.php> Require all denied </Files> directive; note this will disable timetable preview functionality for end users. Deploy a WAF rule blocking SQL metacharacters (', --, UNION, SELECT, OR 1=1) in the course_year_section request parameter to reduce automated exploitation via sqlmap or similar tooling, accepting the trade-off of potential false positives on legitimate input. For organizations with access to the source code, the definitive fix is replacing direct SQL string concatenation in /preview4.php with PDO or MySQLi prepared statements, and restricting course_year_section input to an allowlist of alphanumeric characters and safe delimiters. Monitor https://www.sourcecodester.com/ and https://vuldb.com/vuln/374535 for patch releases.