CVE-2026-14771
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam1.php. An unknown function improperly handles the ID argument, allowing remote attackers to execute arbitrary SQL queries. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely read, modify, or delete database records, potentially leading to data breaches, integrity loss, or full application compromise.
Recommendation
Immediately update the system to the latest version or apply the vendor's patch. If unavailable, temporarily disable access to /edit_exam1.php and implement input validation for the ID parameter.
Other vulnerabilities in SourceCodester Class and Exam Timetabling System
See all- CVE-2026-85512High
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-13565High
In SourceCodester Class and Exam Timetabling System 1.0, the file /edit_class1.php is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-86298High
A vulnerability was discovered in SourceCodester Class and Exam Timetabling System 1.0 in an unknown function of the file /delete_subject.php. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been publicly released.
- CVE-2026-86225High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_room.php is vulnerable to SQL injection via the room_name argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86224High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_product.php is vulnerable to SQL injection via the fname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-86223High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_coursea.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-86222High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course2.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been disclosed to the public.
- CVE-2026-86221High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course1.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been published.
- CVE-2026-86220High
Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit is now public.
- CVE-2026-86210High
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_user_account.php. Manipulating the ID argument allows remote attack execution. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS