Description
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Published: 2026-07-21
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the SourceCodester Class and Exam Timetabling System allows an attacker to inject arbitrary SQL through manipulation of the ID argument in the /edit_subjecta.php script. This injection targets the database layer and can be performed over the network, resulting in potential disclosure, modification, or deletion of sensitive data. The vulnerability is classified as CWE-74 and CWE-89, reflecting unvalidated input and improper use of SQL statements.

Affected Systems

The affected product is SourceCodester Class and Exam Timetabling System, version 1.0. The flaw resides in the /edit_subjecta.php functionality and impacts any instance where this script is deployed.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is remote. However, because the flaw allows compromised SQL execution, the potential impact on confidentiality and integrity remains significant if exploited.

Generated by OpenCVE AI on July 30, 2026 at 16:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the system to the latest patched release that removes the vulnerable code or implements proper input validation.
  • If an update is not available, modify the edit_subjecta.php script to use parameterized queries or safely escape all input before including it in SQL statements.
  • Restrict access to the edit functionality through role‑based access controls or network segmentation so that only authorized administrators can invoke the script.
  • Monitor database and web server logs for abnormal query patterns that may indicate injection attempts.

Generated by OpenCVE AI on July 30, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
Title SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-22T15:33:24.820Z

Reserved: 2026-07-21T15:39:13.592Z

Link: CVE-2026-16484

cve-icon Vulnrichment

Updated: 2026-07-22T15:32:47.947Z

cve-icon NVD

Status : Deferred

Published: 2026-07-21T22:17:00.437

Modified: 2026-07-22T16:25:46.380

Link: CVE-2026-16484

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:15:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')