Which versions of Class and Exam Timetabling System are affected by EUVD-2026-35014?

SourceCodester Class and Exam Timetabling System 1.0 contains an unauthenticated SQL injection vulnerability allowing remote attackers to access or modify exam and student records without…

Is there a public PoC exploit available for EUVD-2026-35014?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35014. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-35014?

Within 24 hours: Scan internal and cloud infrastructure to identify all deployed instances of SourceCodester Class and Exam Timetabling System 1.0 and map which are internet-accessible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection payloads targeting the 'sy' parameter of /archive4.php; implement network segmentation to restrict non-authorized access to the application. Within 30 days: Contact SourceCodester vendor for patch timeline and interim hardening guidance; evaluate replacement with alternative exam management systems with active security maintenance, or plan controlled air-gapping of affected systems.

Class and Exam Timetabling System EUVD-2026-35014

Q: What is the CVSS score of EUVD-2026-35014?

EUVD-2026-35014 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-11483 MEDIUM

SQL Injection (CWE-89)

2026-06-08 VulDB

GHSA-p8pv-jg8q-76hj

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 08, 2026 - 05:22 NVD

HIGH MEDIUM

CVSS changed

Jun 08, 2026 - 05:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 05:15 vuln.today

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /archive4.php. The manipulation of the argument sy results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive4.php to inject arbitrary SQL queries. Publicly available exploit code exists, increasing the risk of opportunistic exploitation against exposed deployments, though no active exploitation has been confirmed via CISA KEV.

Technical ContextAI

The affected application is a PHP-based academic scheduling web application distributed by SourceCodester, a repository of open-source learning projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), in which the 'sy' GET/POST parameter accepted by /archive4.php is concatenated into a backend SQL query without parameterization or sanitization. CPE identification (cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system) confirms the vendor and product, and the 'PHP, SQLi' tags reinforce that this is a classic injection flaw typical of legacy PHP applications that rely on mysql_* or unprepared mysqli calls.

RemediationAI

No vendor-released patch identified at time of analysis; SourceCodester projects are frequently published as code samples without ongoing maintenance, so administrators should not expect an upstream fix. As compensating controls, restrict the application to trusted networks or place it behind authenticated VPN/reverse proxy access, deploy a Web Application Firewall (e.g., ModSecurity OWASP CRS) with rules tuned to block SQL injection patterns on the 'sy' parameter of /archive4.php (with the side effect of false positives on legitimate complex queries), and manually patch /archive4.php to use prepared statements (PDO with bound parameters) or strictly validate 'sy' against an allowlist of academic year tokens. Database accounts used by the application should be granted minimum-necessary privileges to limit the blast radius of injection. Reference the VulDB entry at https://vuldb.com/cve/CVE-2026-11483 for tracking.