Is there a public PoC exploit available for CVE-2026-16484?

Yes, a public proof-of-concept exploit is available for CVE-2026-16484. Prioritise patching immediately. EPSS: 0.4%.

Class and Exam Timetabling System CVE-2026-16484

Q: What is the CVSS score of CVE-2026-16484?

CVE-2026-16484 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-46443 MEDIUM

SQL Injection (CWE-89)

2026-07-21 VulDB

GHSA-q3c9-pwc5-fxqr

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable, no authentication (PR:N per CVSS 4.0 vector), low complexity SQLi; limited C/I/A impact, scope unchanged as injection targets single database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:47 vuln.today

CVSS changed

Jul 21, 2026 - 22:26 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 21, 2026 - 21:30 cve.org

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester (cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the ID query parameter passed to /edit_subjecta.php is concatenated directly into an SQL statement without parameterization or input sanitization. This is a classic first-generation SQL injection pattern common in PHP applications that do not use prepared statements or an ORM layer.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; patch status is unconfirmed from available data. The primary remediation is to replace the vulnerable string-concatenated SQL query in /edit_subjecta.php with parameterized queries or prepared statements using PHP PDO or MySQLi bound parameters, which eliminates the injection surface without side effects. As a compensating control, restrict network access to the application to trusted internal subnets or a VPN - this prevents remote exploitation but does not fix the underlying flaw. Additionally, implement a web application firewall rule to block SQL metacharacters (single quotes, UNION, SELECT keywords) in the ID parameter as a short-term layer of defense. The exploit POC is publicly documented at https://github.com/austincooke723-tech/web-re-cve/issues/1 and the VulDB entry is at https://vuldb.com/vuln/380942.