CVE-2026-86224

5.5 mediumEPSS 0.4%

Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days.

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2026-09-06
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

References

https://github.com/justconter/_CVE/issues/5
https://vuldb.com/cve/CVE-2026-86224
https://vuldb.com/submit/897750
https://vuldb.com/vuln/399377
https://vuldb.com/vuln/399377/cti

Check your stack JSON