CVE-2026-14771
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam1.php. An unknown function improperly handles the ID argument, allowing remote attackers to execute arbitrary SQL queries. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely read, modify, or delete database records, potentially leading to data breaches, integrity loss, or full application compromise.
Recommendation
Immediately update the system to the latest version or apply the vendor's patch. If unavailable, temporarily disable access to /edit_exam1.php and implement input validation for the ID parameter.
Original NVD description (English source)
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.