Is there a public PoC exploit available for CVE-2026-13565?

Yes, a public proof-of-concept exploit is available for CVE-2026-13565. Prioritise patching immediately. EPSS: 0.3%.

Class and Exam Timetabling System CVE-2026-13565

Q: What is the CVSS score of CVE-2026-13565?

CVE-2026-13565 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40076 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-fjj7-q36f-r4pw

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated remote SQLi (AV:N/PR:N) with partial low-level database read/write impact, consistent with CVSS 4.0 VC:L/VI:L/VA:L signals and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:29 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_class1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes database contents through the unsanitized ID parameter in /edit_class1.php, exploitable by unauthenticated remote attackers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites are required and the attack is fully remote with no user interaction. A public proof-of-concept has been disclosed on GitHub, lowering the exploitation barrier; the product is not currently listed in the CISA KEV catalog.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester, a free source-code repository targeting students and developers. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) - the application passes user-supplied input from the HTTP ID parameter directly into a database query without sanitization or parameterization. CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:* uses a wildcard version, indicating all known releases are affected. The specific injection point is the /edit_class1.php script, which handles class record editing and queries the backend database using the attacker-controlled ID value.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester distributes this as a free community code project and does not maintain a formal patch release process. The primary fix is to manually update /edit_class1.php to use parameterized prepared statements (PDO or MySQLi) instead of concatenating the ID value directly into the SQL query - this eliminates the root cause. As a compensating control, restrict access to the timetabling application to trusted internal networks using firewall rules or web server IP allowlists, preventing unauthenticated external access. Deploying a Web Application Firewall (WAF) rule targeting SQL injection patterns in the ID parameter of /edit_class1.php can reduce exploitation risk, though WAF bypass techniques exist and this should not be treated as a complete fix. If the application is not in active use, taking it offline is the lowest-risk option. References: VulDB entry at https://vuldb.com/vuln/374573; POC at https://github.com/Pluto2362/CVE-2026/issues/3.