CVE-2026-86221: SQL Injection in SourceCodester Class and Exam Timetabling System
Description
CVE-2026-86221 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the mysqli_query function within the /admin/modal_add_course1.php file, where manipulation of the 'course' argument allows injection. This vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known reports of active exploitation in the wild. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
CVSS v4.0
Score 6.9medium
Affected software
SourceCodester
Class and Exam Timetabling System
cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-86221 affects SourceCodester Class and Exam Timetabling System 1.0. It is caused by improper sanitization of the 'course' parameter passed to the mysqli_query function in the /admin/modal_add_course1.php script, enabling an attacker to perform SQL injection. This allows remote attackers to manipulate database queries, potentially leading to unauthorized data access or modification. The vulnerability requires no privileges or user interaction to exploit. An exploit has been published publicly.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database impacts depending on the attacker's crafted queries. The vulnerability is remotely exploitable without authentication, increasing its risk. However, there are no confirmed reports of active exploitation in the wild at this time.
Mitigation Recommendations
No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to implement input validation and sanitization on the 'course' parameter to prevent SQL injection. Applying web application firewalls (WAFs) with SQL injection detection rules may provide temporary protection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T03:57:46.177Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9daf7facd9273b491cd65e
Added to database: 09/06/2026, 18:22:55 UTC
Last enriched: 09/15/2026, 00:58:15 UTC
Last updated: 10/21/2026, 13:20:24 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.