CVE-2026-86298: SourceCodester Class and Exam Timetabling System delete_subject.php sql injection
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /deletesubject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely over the network. The supplied CVSS vector indicates no privileges or user interaction are required.
Which input should be investigated first?
The affected endpoint is /delete_subject.php, and the vulnerable argument is ID. Review requests to that endpoint and database activity associated with subject-deletion operations for suspicious ID values.
How urgent is remediation?
The vulnerability is rated high severity with a CVSS score of 7.3. Public exploit availability is reported, which increases the likelihood of attempted exploitation.
What is the expected impact if exploitation succeeds?
The provided scoring indicates low impacts to confidentiality, integrity, and availability. The scope is listed as unchanged.