CVE-2026-86225: SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection
Published Sep 6, 2026
·Updated
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqliquery of the file /admin/modaladdroom.php. The manipulation of the argument roomname leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Affected Software
1 affected component
Sourcecodester Class and Exam Timetabling System=1.0
Event History
Sep 6, 2026
CVE Published
via MITRE·09:15 PM
Data Sourced
via MITRE·09:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What input is vulnerable, and where is it processed?
The vulnerable input is the room_name argument, which reaches mysqli_query in /admin/modal_add_room.php.
2
Can this be exploited remotely without authentication or user interaction?
The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
3
Is exploit code available?
Yes. The vulnerability data states that a public exploit is available and might be used.