PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13486 SourceCodester CVE debrief

CVE-2026-13486 is a SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in the /preview6.php file, where an attacker can manipulate the course_year_section argument to inject malicious SQL code. This can be done remotely, and the exploit has been publicly disclosed. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The vendor is listed as Unknown Vendor, and the product name is not specified. The CVE record was published on 2026-06-28T10:16:27.150Z.

Vendor
SourceCodester
Product
Class and Exam Timetabling System
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-28
Original CVE updated
2026-06-28
Advisory published
2026-06-28
Advisory updated
2026-06-28

Who should care

Security teams and administrators responsible for the SourceCodester Class and Exam Timetabling System 1.0 should be aware of this vulnerability and take immediate action to remediate it. Additionally, developers and researchers interested in secure coding practices and vulnerability disclosure should also take note of this CVE.

Technical summary

The vulnerability is caused by a lack of proper input validation in the /preview6.php file, allowing an attacker to inject malicious SQL code through the course_year_section argument. The attack can be launched remotely, and the exploit has been publicly disclosed. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weaknesses associated with this vulnerability are CWE-74 and CWE-89.

Defensive priority

This vulnerability has a medium severity and should be prioritized for remediation. Security teams should take immediate action to apply any available patches or workarounds to prevent exploitation.

Recommended defensive actions

  • Apply patches or updates to the SourceCodester Class and Exam Timetabling System 1.0 to fix the SQL injection vulnerability.
  • Implement input validation and sanitization to prevent malicious SQL code injection.
  • Monitor the system for suspicious activity and implement logging and auditing to detect potential exploitation attempts.
  • Consider implementing a web application firewall (WAF) to detect and prevent SQL injection attacks.
  • Conduct regular security assessments and penetration testing to identify and address vulnerabilities.

Evidence notes

The CVE record was published on 2026-06-28T10:16:27.150Z, and the vulnerability has been publicly disclosed. The exploit has been made publicly available, and the attack can be launched remotely. The CVSS score is 5.5, and the severity is MEDIUM. The vendor is listed as Unknown Vendor, and the product name is not specified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13486 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13486

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13486 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13486

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.