Class And Exam Timetabling System
Monthly
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.
Missing authorization in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to bypass access controls on the /admin/session.php endpoint by manipulating the ID parameter. The vulnerability, rooted in CWE-862, exposes administrative session logic to arbitrary external actors without requiring any credentials. A public proof-of-concept exploit has been released on GitHub, confirming active exploitability at low skill threshold.
Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSHRM1.php, executing within the victim's browser session when a crafted link is followed. A public proof-of-concept exploit is available via a GitHub issue, lowering the practical bar for exploitation despite the low CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV; impact is bounded by mandatory user interaction and the browser-session scope of injected code.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSCE2.php, executing in the context of a victim's browser upon interaction with a crafted link. A public proof-of-concept exploit exists (GitHub issue, VulDB reference), raising the practical exploitability above the base CVSS 4.0 score of 5.3 would suggest in isolation. No active exploitation is confirmed by CISA KEV, and real-world impact is substantially constrained by the product's narrow academic/student deployment footprint.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_room1.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_exam2.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions, making this trivially exploitable over the network. A public exploit has been released on GitHub (no public exploit identified at time of analysis for KEV, but publicly available exploit code exists per POC data), and while the vulnerability is not listed in the CISA KEV catalog, the zero-friction attack path elevates real-world risk above what the moderate 5.5 CVSS score might suggest.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 exposes users to script injection via the unvalidated `subject` parameter in `/subject.php`, exploitable remotely by unauthenticated attackers. A publicly available proof-of-concept exists on GitHub, confirming practical exploitability with minimal attacker skill. No CISA KEV listing is present; the CVSS 4.0 score of 5.3 reflects limited integrity impact constrained by required user interaction, though POC availability meaningfully elevates real-world risk above the raw score suggests.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `subject` parameter in `/forsubject.php`. A victim user must interact with a crafted URL for the payload to execute in their browser. A public proof-of-concept exploit is available on GitHub, increasing the likelihood of opportunistic exploitation against deployed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /edit_exam1.php to execute arbitrary SQL commands against the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the exploit has been publicly published on GitHub. Real-world impact is limited by the niche, educational-software footprint of this SourceCodester application, but any internet-exposed instance is trivially exploitable given the available POC.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to remote unauthenticated attackers via the unvalidated ID parameter in /edit_class2.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated remote exploitation requiring no special conditions. Publicly available exploit code (E:P) lowers the bar to exploitation further, though the product's niche deployment footprint significantly limits real-world blast radius. No KEV listing; no patch identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_course.php` endpoint to unauthenticated remote database manipulation via a malicious `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and a public proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed in CISA KEV, though the combination of a public POC and fully unauthenticated attack path elevates practical risk for any internet-exposed deployment.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes backend database contents via the `course_year_section` parameter in `/preview3.php`. The CVSS 4.0 vector confirms network-accessible, no-authentication, no-interaction exploitation (AV:N/AC:L/PR:N/UI:N), and exploit code is publicly available (E:P on GitHub). No active exploitation is confirmed in CISA KEV, but the public POC lowers the bar for opportunistic attacks against any publicly exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes database contents through the unsanitized ID parameter in /edit_class1.php, exploitable by unauthenticated remote attackers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites are required and the attack is fully remote with no user interaction. A public proof-of-concept has been disclosed on GitHub, lowering the exploitation barrier; the product is not currently listed in the CISA KEV catalog.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview4.php` endpoint to unauthenticated remote attackers via the `course_year_section` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-prerequisite network exploitation against default deployments, with low-level impact across confidentiality, integrity, and availability of the backend database. No public exploit identified at time of analysis is incorrect here - a public proof-of-concept has been disclosed on GitHub (E:P maturity confirmed), meaningfully lowering the barrier for opportunistic and automated attacks against academic institutions running this software.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_class.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AC:L), no authentication or user interaction is required to initiate the attack, and a public proof-of-concept exploit is available on GitHub. No vendor patch has been identified at time of analysis, leaving deployments with no vendor-sanctioned remediation path.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate database queries via the `course_year_section` parameter in /preview5.php. The input is passed directly into SQL queries without sanitization (CWE-89), enabling data extraction, modification, or availability disruption. A public proof-of-concept exploit is available on GitHub, and no patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview7.php` endpoint to unauthenticated remote exploitation via unsanitized input in the `course_year_section` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation with no authentication or user interaction required. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists (GitHub issue referenced in references), elevating urgency despite the absence of a CISA KEV listing.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes any publicly reachable deployment to unauthenticated database manipulation via the unsanitized `sy` parameter in /archive.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote exploitation with no prerequisites, yielding low-to-moderate impact across confidentiality, integrity, and availability of the underlying database. A publicly available proof-of-concept exploit exists on GitHub (referenced via VulDB submission 838189), lowering attacker skill requirements, though no CISA KEV listing indicates mass exploitation has not been confirmed at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `course_year_section` parameter on the `/preview6.php` endpoint, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, and a public proof-of-concept has been disclosed on GitHub. While not listed in CISA KEV, the trivially low attack complexity combined with POC availability raises the realistic exploitation risk above what the 5.5 medium score alone implies.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview.php` endpoint to remote unauthenticated exploitation via the unsanitized `course_year_section` parameter, allowing arbitrary SQL query execution against the backend database. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier to exploitation. Impact is rated low-to-partial across confidentiality, integrity, and availability, bounded by the database account's privileges, and no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive1.php to inject arbitrary SQL queries against the backend database. Publicly available exploit code exists per VulDB submission 369106, raising the practical risk despite the moderate CVSS 7.3 score. No KEV listing and no public exploitation campaigns identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive2.php to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (disclosed via GitHub), though there is no confirmed active exploitation in CISA KEV. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial impact across confidentiality, integrity, and availability.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive3.php to execute arbitrary database queries. Publicly available exploit code exists, increasing immediate risk to any exposed deployment, though no CISA KEV listing or EPSS data has been provided to indicate widespread active exploitation. The flaw carries a CVSS 7.3 rating reflecting network reachability with no authentication or user interaction required.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive4.php to inject arbitrary SQL queries. Publicly available exploit code exists, increasing the risk of opportunistic exploitation against exposed deployments, though no active exploitation has been confirmed via CISA KEV.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index1.php to unauthenticated remote exploitation via an unsanitized Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier indicates a publicly available proof-of-concept - confirmed via a GitHub issue disclosure. An attacker can manipulate the Password argument to inject arbitrary SQL, potentially bypassing authentication or exfiltrating database contents. No CISA KEV listing is present, and no vendor patch has been identified at time of analysis.
Unauthenticated remote SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index2.php to arbitrary query manipulation via the Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack complexity, making this trivially reachable from the network. Publicly available exploit code exists (POC confirmed via GitHub), though no CISA KEV listing has been issued, meaning widespread active exploitation is not confirmed at time of analysis.
A vulnerability classified as critical was found in SourceCodester Class and Exam Timetabling System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.
Missing authorization in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to bypass access controls on the /admin/session.php endpoint by manipulating the ID parameter. The vulnerability, rooted in CWE-862, exposes administrative session logic to arbitrary external actors without requiring any credentials. A public proof-of-concept exploit has been released on GitHub, confirming active exploitability at low skill threshold.
Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSHRM1.php, executing within the victim's browser session when a crafted link is followed. A public proof-of-concept exploit is available via a GitHub issue, lowering the practical bar for exploitation despite the low CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV; impact is bounded by mandatory user interaction and the browser-session scope of injected code.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSCE2.php, executing in the context of a victim's browser upon interaction with a crafted link. A public proof-of-concept exploit exists (GitHub issue, VulDB reference), raising the practical exploitability above the base CVSS 4.0 score of 5.3 would suggest in isolation. No active exploitation is confirmed by CISA KEV, and real-world impact is substantially constrained by the product's narrow academic/student deployment footprint.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_room1.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_exam2.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions, making this trivially exploitable over the network. A public exploit has been released on GitHub (no public exploit identified at time of analysis for KEV, but publicly available exploit code exists per POC data), and while the vulnerability is not listed in the CISA KEV catalog, the zero-friction attack path elevates real-world risk above what the moderate 5.5 CVSS score might suggest.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 exposes users to script injection via the unvalidated `subject` parameter in `/subject.php`, exploitable remotely by unauthenticated attackers. A publicly available proof-of-concept exists on GitHub, confirming practical exploitability with minimal attacker skill. No CISA KEV listing is present; the CVSS 4.0 score of 5.3 reflects limited integrity impact constrained by required user interaction, though POC availability meaningfully elevates real-world risk above the raw score suggests.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `subject` parameter in `/forsubject.php`. A victim user must interact with a crafted URL for the payload to execute in their browser. A public proof-of-concept exploit is available on GitHub, increasing the likelihood of opportunistic exploitation against deployed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /edit_exam1.php to execute arbitrary SQL commands against the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the exploit has been publicly published on GitHub. Real-world impact is limited by the niche, educational-software footprint of this SourceCodester application, but any internet-exposed instance is trivially exploitable given the available POC.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to remote unauthenticated attackers via the unvalidated ID parameter in /edit_class2.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated remote exploitation requiring no special conditions. Publicly available exploit code (E:P) lowers the bar to exploitation further, though the product's niche deployment footprint significantly limits real-world blast radius. No KEV listing; no patch identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_course.php` endpoint to unauthenticated remote database manipulation via a malicious `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and a public proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed in CISA KEV, though the combination of a public POC and fully unauthenticated attack path elevates practical risk for any internet-exposed deployment.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes backend database contents via the `course_year_section` parameter in `/preview3.php`. The CVSS 4.0 vector confirms network-accessible, no-authentication, no-interaction exploitation (AV:N/AC:L/PR:N/UI:N), and exploit code is publicly available (E:P on GitHub). No active exploitation is confirmed in CISA KEV, but the public POC lowers the bar for opportunistic attacks against any publicly exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes database contents through the unsanitized ID parameter in /edit_class1.php, exploitable by unauthenticated remote attackers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no prerequisites are required and the attack is fully remote with no user interaction. A public proof-of-concept has been disclosed on GitHub, lowering the exploitation barrier; the product is not currently listed in the CISA KEV catalog.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview4.php` endpoint to unauthenticated remote attackers via the `course_year_section` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-prerequisite network exploitation against default deployments, with low-level impact across confidentiality, integrity, and availability of the backend database. No public exploit identified at time of analysis is incorrect here - a public proof-of-concept has been disclosed on GitHub (E:P maturity confirmed), meaningfully lowering the barrier for opportunistic and automated attacks against academic institutions running this software.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_class.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AC:L), no authentication or user interaction is required to initiate the attack, and a public proof-of-concept exploit is available on GitHub. No vendor patch has been identified at time of analysis, leaving deployments with no vendor-sanctioned remediation path.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate database queries via the `course_year_section` parameter in /preview5.php. The input is passed directly into SQL queries without sanitization (CWE-89), enabling data extraction, modification, or availability disruption. A public proof-of-concept exploit is available on GitHub, and no patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview7.php` endpoint to unauthenticated remote exploitation via unsanitized input in the `course_year_section` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation with no authentication or user interaction required. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists (GitHub issue referenced in references), elevating urgency despite the absence of a CISA KEV listing.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes any publicly reachable deployment to unauthenticated database manipulation via the unsanitized `sy` parameter in /archive.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote exploitation with no prerequisites, yielding low-to-moderate impact across confidentiality, integrity, and availability of the underlying database. A publicly available proof-of-concept exploit exists on GitHub (referenced via VulDB submission 838189), lowering attacker skill requirements, though no CISA KEV listing indicates mass exploitation has not been confirmed at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `course_year_section` parameter on the `/preview6.php` endpoint, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, and a public proof-of-concept has been disclosed on GitHub. While not listed in CISA KEV, the trivially low attack complexity combined with POC availability raises the realistic exploitation risk above what the 5.5 medium score alone implies.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview.php` endpoint to remote unauthenticated exploitation via the unsanitized `course_year_section` parameter, allowing arbitrary SQL query execution against the backend database. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier to exploitation. Impact is rated low-to-partial across confidentiality, integrity, and availability, bounded by the database account's privileges, and no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive1.php to inject arbitrary SQL queries against the backend database. Publicly available exploit code exists per VulDB submission 369106, raising the practical risk despite the moderate CVSS 7.3 score. No KEV listing and no public exploitation campaigns identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive2.php to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (disclosed via GitHub), though there is no confirmed active exploitation in CISA KEV. The CVSS 7.3 score reflects network-reachable, no-authentication exploitation with partial impact across confidentiality, integrity, and availability.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter in /archive3.php to execute arbitrary database queries. Publicly available exploit code exists, increasing immediate risk to any exposed deployment, though no CISA KEV listing or EPSS data has been provided to indicate widespread active exploitation. The flaw carries a CVSS 7.3 rating reflecting network reachability with no authentication or user interaction required.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate the 'sy' parameter of /archive4.php to inject arbitrary SQL queries. Publicly available exploit code exists, increasing the risk of opportunistic exploitation against exposed deployments, though no active exploitation has been confirmed via CISA KEV.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index1.php to unauthenticated remote exploitation via an unsanitized Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and the E:P modifier indicates a publicly available proof-of-concept - confirmed via a GitHub issue disclosure. An attacker can manipulate the Password argument to inject arbitrary SQL, potentially bypassing authentication or exfiltrating database contents. No CISA KEV listing is present, and no vendor patch has been identified at time of analysis.
Unauthenticated remote SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the login endpoint /index2.php to arbitrary query manipulation via the Password parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack complexity, making this trivially reachable from the network. Publicly available exploit code exists (POC confirmed via GitHub), though no CISA KEV listing has been issued, meaning widespread active exploitation is not confirmed at time of analysis.
A vulnerability classified as critical was found in SourceCodester Class and Exam Timetabling System 1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.