Is there a public PoC exploit available for CVE-2026-16154?

Yes, a public proof-of-concept exploit is available for CVE-2026-16154. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-16154

Q: What is the CVSS score of CVE-2026-16154?

CVE-2026-16154 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

MEDIUM

SQL Injection (CWE-89)

2026-07-18 VulDB

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible, unauthenticated SQLi with no interaction; scope unchanged, limited C/I/A as impact is confined to the application database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 18, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 18, 2026 - 20:46 vuln.today

CVE Published

Jul 18, 2026 - 20:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_room1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_room1.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic scheduling application distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that the ID parameter passed to /edit_room1.php is concatenated directly into a SQL query without parameterization or escaping. This is a classic first-order SQLi pattern common in unvalidated PHP applications that construct queries via string interpolation rather than prepared statements with bound parameters. The wildcard version in the CPE string suggests the flaw may not be version-specific but is confirmed for version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis; the SourceCodester product page (https://www.sourcecodester.com/) should be monitored for updates. The primary code-level fix is to replace string-concatenated SQL queries in /edit_room1.php with PHP PDO or MySQLi prepared statements using bound parameters, eliminating the injection surface entirely. As an immediate compensating control, restrict network access to the application to trusted IP ranges or place it behind a web application firewall (WAF) configured to block SQL injection patterns targeting the ID parameter - note that WAF-based mitigations can be bypassed by sufficiently obfuscated payloads and should not be treated as a permanent fix. If the room-editing feature is non-essential, disabling or removing /edit_room1.php eliminates the exposed attack surface with no functional side effects on unrelated application features. The public POC referenced at https://github.com/justconter/cve/issues/5 can be used to verify remediation effectiveness in a controlled test environment.