Is there a public PoC exploit available for CVE-2026-16227?

Yes, a public proof-of-concept exploit is available for CVE-2026-16227. Prioritise patching immediately. EPSS: 0.4%.

Timetabling System CVE-2026-16227

Q: What is the CVSS score of CVE-2026-16227?

CVE-2026-16227 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45443 MEDIUM

SQL Injection (CWE-89)

2026-07-19 VulDB

GHSA-xhgr-3rc4-c8v5

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network vector, no auth, no interaction required; scope unchanged; partial C/I/A consistent with standard SQL injection against a restricted database account.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 19, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 19, 2026 - 10:21 vuln.today

CVE Published

Jul 19, 2026 - 09:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_subject.php endpoint to unauthenticated remote exploitation via the unsanitized id parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.

Technical ContextAI

The affected product is SourceCodester Class and Exam Timetabling System 1.0, a PHP-based academic scheduling web application identified by CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements in an SQL Command), a classic pattern in PHP applications that concatenate user-supplied input directly into SQL query strings without prepared statements or parameterized queries. The id parameter in /edit_subject.php is the injection point; unsanitized values are interpolated into a backend SQL query, allowing an attacker to alter query logic. This class of flaw is trivially exploitable using standard tools such as sqlmap and requires no exploitation chaining.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is a code-level fix: replace direct string interpolation of the id parameter in /edit_subject.php with parameterized queries or prepared statements using PHP's PDO or MySQLi APIs - this eliminates the injection surface entirely and has no functional side effects. As an immediate compensating control, restrict access to /edit_subject.php via web server configuration (e.g., Apache Require ip or nginx allow/deny directives) to trusted administrative IP ranges; note this will block legitimate administrative use from unrecognized networks. Deploying a WAF rule targeting SQL metacharacters on the id parameter can reduce opportunistic exploitation but is bypassable by determined attackers and should not substitute for the code fix. Given that SourceCodester projects are frequently educational or demo deployments, removing public internet exposure entirely should be evaluated as a first step. References: https://vuldb.com/vuln/380049 and https://github.com/fichterclapsaddle879-rgb/MyCve/issues/2.