Is there a public PoC exploit available for CVE-2026-14641?

Yes, a public proof-of-concept exploit is available for CVE-2026-14641. Prioritise patching immediately. EPSS: 0.4%.

Timetabling System CVE-2026-14641

Q: What is the CVSS score of CVE-2026-14641?

CVE-2026-14641 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41689 MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint requires no interaction; impact capped at Low across CIA reflecting partial database access bounded by database user privileges.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 04, 2026 - 19:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 04, 2026 - 19:17 vuln.today

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_course.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_course.php endpoint to unauthenticated remote database manipulation via a malicious id parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and a public proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed in CISA KEV, though the combination of a public POC and fully unauthenticated attack path elevates practical risk for any internet-exposed deployment.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: the id parameter supplied to /edit_course.php is concatenated directly into a backend SQL query without sanitization or parameterized binding, a textbook first-order SQL injection pattern common in tutorial-grade PHP/MySQL applications. Because SourceCodester distributes application source code rather than managed packages, patching relies entirely on manual code-level remediation by whoever deployed the application.

RemediationAI

No vendor-released patch has been identified at time of analysis. SourceCodester does not maintain a formal patch channel; the fix must be applied manually at the code level. The primary remediation is to rewrite the SQL query in /edit_course.php to use PDO or MySQLi prepared statements with parameterized queries, which neutralizes the id injection point at its root. As a compensating control, deploy a web application firewall rule to detect and block SQL injection patterns targeting this endpoint - noting this does not fix the underlying flaw and may be bypassed by obfuscated payloads. Network-level access controls restricting the application to trusted IP ranges or an internal network will prevent unauthenticated internet-facing exploitation but introduce access friction for legitimate users. If the system is not operationally required, taking it offline is the safest posture given the public POC and absence of a vendor patch. No advisory URL is available; VulDB tracking is at https://vuldb.com/vuln/376157.