Class and Exam Timetabling System CVE-2026-14733

Q: What is the CVSS score of CVE-2026-14733?

CVE-2026-14733 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41741 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-hxg4-x2rp-8xx5

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable endpoint, no authentication required (PR:N), no interaction needed; impact limited to partial database read/write/delete, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 09:34 vuln.today

DescriptionCVE.org

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_coursea.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application's database to unauthenticated remote attackers through the unsanitized 'ID' parameter in /edit_coursea.php. The CVSS 4.0 E:P modifier and the CVE description both confirm that public exploit code exists, lowering the bar for opportunistic exploitation. Impact is assessed as limited across confidentiality, integrity, and availability (all Low), but the absence of authentication requirements makes this accessible to any network-reachable attacker.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester, a repository of small open-source web applications. The vulnerability is classified under CWE-74 (Injection), which encompasses failures to neutralize special elements that could alter the intended command structure of a query. Specifically, the 'ID' parameter passed to /edit_coursea.php is incorporated into a SQL query without proper parameterization or escaping, enabling SQL injection. This is a classic first-order SQL injection pattern common in low-complexity PHP applications that use direct string concatenation to build queries rather than PDO or MySQLi prepared statements. No CPE string was provided in the source data, so affected version scope is limited to version 1.0 as stated in the description.

RemediationAI

No vendor-released patch has been identified at the time of this analysis. The primary remediation is to refactor /edit_coursea.php to use parameterized queries or prepared statements via PHP's PDO or MySQLi extensions, replacing any direct string interpolation of the 'ID' parameter into SQL queries. As a compensating control, administrators can restrict network access to the application to trusted IP ranges only, reducing exposure to unauthenticated remote attackers - note this does not eliminate risk from insider threats or compromised internal hosts. Deploying a web application firewall (WAF) rule to detect and block SQL injection patterns in the 'id' parameter provides a partial layer of defense, though WAF bypass is possible with obfuscation. The SourceCodester project page (https://www.sourcecodester.com/) and VulDB submission (https://vuldb.com/vuln/376315) should be monitored for patch availability.