Is there a public PoC exploit available for CVE-2026-13566?

Yes, a public proof-of-concept exploit is available for CVE-2026-13566. Prioritise patching immediately. EPSS: 0.3%.

Class Timetabling System CVE-2026-13566

Q: What is the CVSS score of CVE-2026-13566?

CVE-2026-13566 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40077 MEDIUM

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-9p45-w3r5-c7w8

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi enables full database read (C:H) and partial data write (I:L); no availability impact expected from read-biased injection against a PHP timetabling app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:29 vuln.today

CVSS changed

Jun 29, 2026 - 14:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /preview3.php. The manipulation of the argument course_year_section leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes backend database contents via the course_year_section parameter in /preview3.php. The CVSS 4.0 vector confirms network-accessible, no-authentication, no-interaction exploitation (AV:N/AC:L/PR:N/UI:N), and exploit code is publicly available (E:P on GitHub). No active exploitation is confirmed in CISA KEV, but the public POC lowers the bar for opportunistic attacks against any publicly exposed instance.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input in the course_year_section HTTP parameter is interpolated directly into a SQL query within /preview3.php without adequate parameterization or escaping. PHP applications using legacy mysql_* or mysqli query construction without prepared statements are a common source of this flaw class. Because the CPE wildcard covers all versions, version 1.0 is the only confirmed release and no patched version exists in the CPE data.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace direct string interpolation in the /preview3.php SQL query with parameterized queries or prepared statements (PDO or MySQLi with bound parameters), which eliminates the injection vector at the root cause level. As an immediate compensating control, restrict network access to /preview3.php at the web server or firewall level if the endpoint does not require public exposure - this prevents unauthenticated remote exploitation at the cost of limiting the scheduling preview feature to internal users only. Additionally, deploy a web application firewall (WAF) rule to detect and block SQL metacharacter sequences in the course_year_section parameter; note that WAF rules are bypassable and should not be treated as a permanent fix. Input validation (allowlisting alphanumeric and hyphen characters for course-year-section identifiers) provides a defense-in-depth layer but is not a substitute for parameterized queries. References: VulDB entry at https://vuldb.com/vuln/374574 and https://vuldb.com/cve/CVE-2026-13566.