CVE-2026-86220: SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection
Published Sep 6, 2026
·Updated
A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The affected element is the function mysqliquery of the file /admin/modaladdcourse.php. The manipulation of the argument course results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected Software
1 affected component
Sourcecodester Class and Exam Timetabling System=1.0
Event History
Sep 6, 2026
CVE Published
via MITRE·05:15 PM
Data Sourced
via MITRE·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied vector. Systems exposing the affected administrative endpoint are the relevant exposure.
2
What input is vulnerable?
The SQL injection is triggered by manipulating the course argument handled by /admin/modal_add_course.php, where it reaches mysqli_query.
3
Is public exploit code available?
Yes. The vulnerability data states that an exploit is public and may be used.