Is there a public PoC exploit available for CVE-2026-16228?

Yes, a public proof-of-concept exploit is available for CVE-2026-16228. Prioritise patching immediately. EPSS: 0.4%.

Class and Exam Timetabling System CVE-2026-16228

Q: What is the CVSS score of CVE-2026-16228?

CVE-2026-16228 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45444 MEDIUM

SQL Injection (CWE-89)

2026-07-19 VulDB

GHSA-cwxm-jprj-j7vp

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable PHP endpoint, no auth required per PR:N; low partial impact on all three pillars consistent with application-scope SQLi against a single-database web app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 19, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 19, 2026 - 10:21 vuln.today

CVE Published

Jul 19, 2026 - 09:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester, identified by CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input passed to the ID parameter in /edit_schoolyr.php is concatenated directly into a SQL query without parameterization or escaping. This is a classic PHP-era anti-pattern where query construction relies on raw GET/POST values. The wildcard CPE version string suggests no version has been confirmed safe by the reporter.

RemediationAI

No vendor-released patch identified at time of analysis. SourceCodester does not publish formal security advisories or versioned releases in the conventional sense, so no fix version can be cited. For operators running this application, the primary remediation is to manually patch the source code by replacing direct SQL string concatenation in /edit_schoolyr.php with prepared statements and parameterized queries (e.g., PHP PDO or MySQLi with bound parameters) - this eliminates the root cause with no functional side effects. As an immediate compensating control, restrict network access to /edit_schoolyr.php using web server ACLs (Apache .htaccess or nginx location blocks) to trusted IP ranges only; this blocks remote exploitation but may impact legitimate administrative users. Deploying a WAF rule targeting SQLi payloads in the ID parameter provides a secondary filter but should not be treated as a primary fix due to bypass risk. If the application is not actively used in production, taking it offline is the lowest-risk option. The vendor page is https://www.sourcecodester.com/ and the VulDB record is at https://vuldb.com/vuln/380050.