Timetabling System CVE-2026-14770

Q: What is the CVSS score of CVE-2026-14770?

CVE-2026-14770 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41780 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-9chf-65gj-5q8w

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

SQL injection typically yields full DB read (C:H); PR:N confirmed by CVSS 4.0 source vector; integrity and availability impacts limited without stacked queries.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 21:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized ID parameter in /edit_room.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special conditions are required, and the E:P supplemental metric confirms public exploit code exists. An attacker can read, modify, or partially disrupt the underlying database without any prior access to the application.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed freely by SourceCodester, a platform that publishes open-source PHP/MySQL scripts primarily for educational and demonstration purposes. The root cause is CWE-74 (Injection), specifically SQL injection - the ID parameter passed to /edit_room.php is interpolated directly into a database query without parameterization or input sanitization. PHP applications interacting with MySQL/MariaDB via unsanitized GET/POST parameters are a classic vector for this class of flaw. No CPE string was provided in the intelligence data, but the product version is identified as 1.0 from the description.

RemediationAI

No vendor-released patch has been identified at the time of analysis. The referenced GitHub issue (https://github.com/orionyan520/cve_report/issues/3) and VulDB entry (https://vuldb.com/vuln/376360) document the vulnerability but provide no fix version from SourceCodester. The primary remediation is to refactor /edit_room.php to use parameterized queries or prepared statements instead of direct string interpolation of the ID parameter - this eliminates the injection surface entirely. As a compensating control, restrict network access to the application to trusted internal IP ranges, preventing external exploitation while awaiting a code fix. Additionally, implement a web application firewall (WAF) rule to block SQL metacharacter patterns in the ID parameter; note this is bypassable with obfuscation and is not a permanent fix. Deploying the application behind authentication (even HTTP Basic Auth at the web server level) would raise the bar from PR:N to PR:L, significantly reducing opportunistic risk. Operators should review all other parameters across the application for the same pattern, as this codebase likely has additional unsanitized inputs given the coding style.