Is there a public PoC exploit available for CVE-2026-14771?

Yes, a public proof-of-concept exploit is available for CVE-2026-14771. Prioritise patching immediately. EPSS: 0.3%.

Class Timetabling System CVE-2026-14771

Q: What is the CVSS score of CVE-2026-14771?

CVE-2026-14771 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41781 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-3hqq-8q66-32qj

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable with no auth or interaction; scope unchanged; all three impact dimensions low matching the 4.0 VC:L/VI:L/VA:L assessment.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 22:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 22:15 vuln.today

DescriptionCVE.org

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /edit_exam1.php to execute arbitrary SQL commands against the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the exploit has been publicly published on GitHub. Real-world impact is limited by the niche, educational-software footprint of this SourceCodester application, but any internet-exposed instance is trivially exploitable given the available POC.

Technical ContextAI

The affected product is a PHP-based academic scheduling application distributed by SourceCodester (cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*), a platform publishing free open-source PHP scripts primarily used in student/educational projects. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the application passes user-controlled input from the HTTP ID parameter directly into a SQL query without sanitization or parameterization in the /edit_exam1.php handler. This classic unsanitized-input-to-query-string pattern in PHP applications typically enables both UNION-based and error-based data extraction, and potentially blind time-based techniques depending on database error visibility configuration.

RemediationAI

No vendor-released patch has been identified at time of analysis. The SourceCodester project does not appear to have issued a formal security advisory or updated release. As an immediate compensating control, administrators should restrict access to /edit_exam1.php via web server configuration (e.g., IP allowlisting or HTTP authentication at the server level) to prevent unauthenticated network access - note this does not fix the underlying flaw but reduces exposure. A Web Application Firewall (WAF) rule blocking SQL metacharacters (single quotes, UNION, SELECT keywords) in the ID parameter can block known POC patterns but may be bypassed by encoding variants. The definitive fix requires replacing the raw SQL concatenation in edit_exam1.php with parameterized prepared statements using PDO or MySQLi - this is the only reliable remediation. Given the educational nature of the software, organizations should evaluate whether this application should be internet-facing at all. References: VulDB entry at https://vuldb.com/vuln/376361 and POC at https://github.com/orionyan520/cve_report/issues/2.