Is there a public PoC exploit available for EUVD-2026-39987?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39987. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System EUVD-2026-39987

Q: What is the CVSS score of EUVD-2026-39987?

EUVD-2026-39987 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-13487 MEDIUM

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-2x9m-qqmr-95g7

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-exploitable with no authentication or user interaction; scope unchanged with low per-axis database impact consistent with CVSS 4.0 VC:L/VI:L/VA:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 28, 2026 - 11:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 28, 2026 - 11:16 vuln.today

DescriptionCVE.org

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulation of the argument sy leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes any publicly reachable deployment to unauthenticated database manipulation via the unsanitized sy parameter in /archive.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote exploitation with no prerequisites, yielding low-to-moderate impact across confidentiality, integrity, and availability of the underlying database. A publicly available proof-of-concept exploit exists on GitHub (referenced via VulDB submission 838189), lowering attacker skill requirements, though no CISA KEV listing indicates mass exploitation has not been confirmed at time of analysis.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool (SourceCodester Class and Exam Timetabling System 1.0, CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*) that constructs SQL queries using unsanitized user-supplied input. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the sy parameter - likely representing a school year filter - in /archive.php is passed directly into a SQL query without parameterization or escaping. This classic PHP SQLi pattern enables an attacker to manipulate the SQL statement structure, potentially reading arbitrary database tables, modifying records, or causing query errors that degrade availability. No ORM or prepared-statement layer appears to be in use for this parameter.

RemediationAI

No vendor-released patched version has been identified at time of analysis; the absence of a patch reference in VulDB or the SourceCodester vendor site means the primary fix - upgrading to a patched release - is not currently available. Administrators should immediately replace direct variable interpolation in /archive.php SQL queries with parameterized prepared statements (PDO or MySQLi with bound parameters) as the definitive fix. As a compensating control, restrict public access to /archive.php via web server ACLs or firewall rules, limiting requests to trusted IP ranges only - this eliminates the AV:N attack vector but may disrupt legitimate archive functionality. Deploying a web application firewall (WAF) with SQL injection detection rules targeting the sy parameter can reduce exploitation risk with minimal functionality impact. Input validation rejecting non-numeric or non-alphanumeric values for the sy parameter (if it represents a school year such as '2025-2026') provides an additional defense layer. Monitor web server logs for anomalous patterns in /archive.php requests. Reference: https://vuldb.com/vuln/374484 and the POC at https://github.com/lffaker/cybersec/issues/4 for reproduction details.