CVE-2026-86224: SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqliquery of the file /admin/modaladdproduct.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for assessment?
SourceCodester Class and Exam Timetabling System version 1.0 should be assessed, particularly instances whose administrative application includes /admin/modal_add_product.php.
Does exploitation require an authenticated account or user interaction?
The supplied CVSS vector indicates network exploitation with no privileges required and no user interaction required. The vulnerability description also states that the attack can be executed remotely.
How urgent is remediation or exposure reduction?
The exploit has been publicly disclosed and may be used. The reported impact includes confidentiality, integrity, and availability effects, each rated low in the supplied CVSS vector.