Is there a public PoC exploit available for CVE-2026-15597?

Yes, a public proof-of-concept exploit is available for CVE-2026-15597. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-15597

Q: What is the CVSS score of CVE-2026-15597?

CVE-2026-15597 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

SQL Injection (CWE-89)

2026-07-13 VulDB

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no complexity; limited CIA impact as injection scope is constrained to the application database with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:31 vuln.today

CVSS changed

Jul 13, 2026 - 22:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 13, 2026 - 21:45 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_exam2.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions, making this trivially exploitable over the network. A public exploit has been released on GitHub (no public exploit identified at time of analysis for KEV, but publicly available exploit code exists per POC data), and while the vulnerability is not listed in the CISA KEV catalog, the zero-friction attack path elevates real-world risk above what the moderate 5.5 CVSS score might suggest.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester, a provider of open-source student projects commonly deployed in educational institutions. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input to the ID parameter in /edit_exam2.php is concatenated directly into a backend SQL query without parameterization or adequate escaping. The CPE string cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not constrained the vulnerability to a specific release - all tracked versions are considered affected. The description references a file path suffix of 1.0/2.php, suggesting a flat directory structure typical of low-complexity PHP applications that often lack secure coding practices such as prepared statements or ORM abstraction layers.

RemediationAI

No vendor-released patch identified at time of analysis. The primary remediation is to replace direct SQL string concatenation in /edit_exam2.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions, which eliminates the injection vector entirely. As an immediate compensating control, restrict network access to the application to trusted IP ranges or internal networks only, reducing the attack surface from internet-exposed to locally accessible. Deploying a Web Application Firewall (WAF) rule blocking common SQL injection patterns (e.g., UNION SELECT, single-quote sequences, comment sequences) in the ID parameter can provide partial mitigation but should not be relied upon as a primary control since WAF rules can be bypassed. Input validation enforcing that the ID parameter accepts only numeric values is a low-friction server-side control that would block most injection payloads with minimal side effects. Reference the VulDB advisory at https://vuldb.com/vuln/378112 and the exploit disclosure at https://github.com/asdasddqwdq29-a11y/new-cve/issues/1 for payload specifics to validate any mitigations applied.