Is there a public PoC exploit available for CVE-2026-86209?

Yes, a public proof-of-concept exploit is available for CVE-2026-86209. Prioritise patching immediately. EPSS: 0.4%.

Timetabling System CVE-2026-86209

Q: What is the CVSS score of CVE-2026-86209?

CVE-2026-86209 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-72088 MEDIUM

SQL Injection (CWE-89)

2026-09-06 VulDB

GHSA-ppmh-p35q-fcjx

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Unauthenticated network SQLi with partial data read/write; no availability impact demonstrated, and no scope change from this endpoint.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 06, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Sep 06, 2026 - 10:00 vuln.today

CVE Published

Sep 06, 2026 - 09:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond network access to the web application - exploitation targets the unauthenticated /delete_user.php endpoint, which accepts the ID parameter without any session or authentication check (confirmed by PR:N in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, unauthenticated, low-complexity exploitation, and the E:P supplemental metric confirms a public exploit exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch has been identified at time of analysis - the references point only to VulDB and a GitHub POC issue, with no upstream fix or advisory from SourceCodester. … Detailed patch versions, workarounds, and compensating controls in full report.