CVE-2026-86210: SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Can this be exploited remotely without authentication or user interaction?
Yes. The available scoring data indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
Which component should be prioritized for investigation?
Investigate the /delete_user_account.php endpoint, specifically its handling of the ID argument. The vulnerability is an SQL injection issue in an unknown function within that file.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.
What is the potential impact if exploitation succeeds?
The provided severity vector indicates low impact to confidentiality, integrity, and availability. The scope is unchanged.