Is there a public PoC exploit available for CVE-2026-16152?

Yes, a public proof-of-concept exploit is available for CVE-2026-16152. Prioritise patching immediately. EPSS: 0.3%.

Class and Exam Timetabling System CVE-2026-16152

Q: What is the CVSS score of CVE-2026-16152?

CVE-2026-16152 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

SQL Injection (CWE-89)

2026-07-18 VulDB

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQL injection with no user interaction; partial CIA impact and no scope change align with the 4.0 VC:L/VI:L/VA:L/SC:N profile.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 18, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 18, 2026 - 20:46 vuln.today

CVE Published

Jul 18, 2026 - 20:00 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.

Technical ContextAI

The affected component is a PHP-based web application - SourceCodester Class and Exam Timetabling System 1.0 (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*) - distributed via the SourceCodester platform as a free academic scheduling tool. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), wherein the /edit_rooma.php script passes the HTTP-supplied ID parameter directly into a backend SQL query without parameterization or sanitization. This is a textbook unsanitized input injection pattern, trivially exploitable in PHP applications that do not use prepared statements or PDO with bound parameters. The wildcard version in the CPE string suggests all versions of the product may share the same vulnerable code path.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to refactor /edit_rooma.php to use PHP PDO or MySQLi prepared statements with bound parameters for the ID value, eliminating the injection vector entirely. As a compensating control, deploy a web application firewall (WAF) with SQL injection rule sets (e.g., OWASP ModSecurity Core Rule Set) in front of the application to detect and block malicious payloads - note this adds operational overhead and may produce false positives requiring tuning. Restricting access to the application to internal/trusted networks via firewall or .htaccess IP allowlisting reduces the network-accessible attack surface without modifying application code. Given that SourceCodester applications are typically educational or demo-grade and not designed for production exposure, seriously evaluate whether this system requires public internet accessibility at all. The VulDB entry is available at https://vuldb.com/vuln/379918 and the public PoC at https://github.com/justconter/cve/issues/6.