Timetabling System CVE-2026-14732

Q: What is the CVSS score of CVE-2026-14732?

CVE-2026-14732 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41740 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-c45c-wjf5-qv6c

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible with no auth or complexity; partial C/I/A impact consistent with SQL injection without DBA-level or OS-level escalation; no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 09:33 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_exam.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application's database through the unsanitized ID parameter in /edit_exam.php, reachable by unauthenticated remote attackers. The exploit has been publicly disclosed (CVSS 4.0 E:P), allowing any actor with network access to enumerate, read, or manipulate database contents. No KEV listing is present; exploitation appears opportunistic rather than targeted, consistent with the niche deployment footprint of this product.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester, a platform providing free PHP scripts primarily for student and hobbyist developers. CWE-74 (Injection) is the reported root cause class, which encompasses SQL injection - the specific variant here. The /edit_exam.php endpoint constructs a SQL query incorporating the user-supplied ID parameter without parameterization or adequate sanitization, allowing an attacker to alter query logic. No CPE strings were provided in the source data, but the product is identified as version 1.0. The PHP tag in the intelligence data confirms server-side PHP execution, typical of SourceCodester projects using MySQL as the backend.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace the vulnerable SQL query in /edit_exam.php with parameterized prepared statements or a PDO-based approach, eliminating the injection surface entirely. As a compensating control, deploying a web application firewall (WAF) with SQL injection rules in front of the application can block common payloads, though WAFs can be bypassed by sophisticated attackers. Restricting access to the /edit_exam.php endpoint at the network perimeter (e.g., limiting access to authenticated administrative IP ranges via firewall or .htaccess) reduces exposure without modifying application code. If the system is non-critical, taking it offline until the code is patched is the lowest-risk option. References: https://github.com/cyberdrinclj/pcve/issues/1 (PoC disclosure), https://vuldb.com/vuln/376314 (VulDB entry).