Description
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A SQL injection flaw exists in the edit_course1.php page of SourceCodester Class and Exam Timetabling System 1.0. The vulnerability originates when the ID parameter is manipulated, allowing an attacker to inject arbitrary sensitive of database records, or execution of unintended queries, thereby compromising data integrity and confidentiality.

Affected Systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. The flaw is limited to the edit_course1.php component and does not or later releases mentioned in the data.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of <1% suggests a low but nonzero exploitation probability. The vulnerability is publicly disclosed and is not listed in the CISA KEV catalog, implying no widespread attacks have been reported yet. The likely attack vector is a remote request to edit_course1.php with a crafted ID value; based on the description, it is inferred that no authentication is required for exploitation and that public internet access is sufficient.

Generated by OpenCVE AI on July 26, 2026 at 21:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s official patch or update for Source Timetabling System when it becomes available.
  • Limit external access to the edit_course1.php endpoint so that only authorized administrators can reach it or block the URL entirely from public networks.
  • Implement strong input validation and use parameterized queries for all database operations that involve the ID field to eliminate unsanitized input and address the root cause defined by CWE‑74 and CWE‑89.

Generated by OpenCVE AI on July 26, 2026 at 21:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Title SourceCodester Class and Exam Timetabling System edit_course1.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T13:16:00.262Z

Reserved: 2026-07-05T04:01:35.626Z

Link: CVE-2026-14772

cve-icon Vulnrichment

Updated: 2026-07-06T13:15:55.484Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')