PT-2026-47244

CVE-2026-11482

Published

2026-06-08

Updated

2026-06-10

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0

Description An SQL injection issue exists that can be initiated remotely. The flaw is located in an unknown function within the '/archive5.php' endpoint, where manipulation of the sy argument allows for the execution of arbitrary SQL commands.

Recommendations Update SourceCodester Class and Exam Timetabling System version 1.0 to a patched version. As a temporary workaround, restrict access to the '/archive5.php' endpoint or avoid using the sy parameter until a fix is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Moist

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers