CVE Alert: CVE-2026-86224 – SourceCodester

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Treat as an urgent remediation candidate because exploitation is publicly disclosed and the attack requires no authentication or user interaction; KEV and SSVC exploitation status are not provided, so active exploitation cannot be confirmed.

Successful exploitation could expose timetable, user or administrative data and allow unauthorised changes to application records. Attackers may also use database access to identify privileged accounts, plant persistent content, disrupt scheduling services or pivot through credentials and secrets stored by the application.

### Most likely attack path

An attacker can send crafted HTTP requests directly to the exposed web application and manipulate an input processed by a database query. The low-complexity, unauthenticated path needs no victim action, making automated probing practical. Scope is unchanged, but compromise of the application and its database could materially affect connected users and operational workflows.

### Who is most exposed

Internet-facing deployments, especially small organisations running the application on shared hosting or with default administrative exposure, are the highest-risk population. Sites lacking web-application firewalls, database separation or centralised logging have reduced detection and containment capability.

Alert on anomalous requests to administrative application functions, including quote, and union-style SQL metacharacters.

Review web-server logs for repeated parameter fuzzing, database errors or unusual response-size changes.

Monitor database audit logs for unexpected queries, schema access, bulk reads or account changes from the application service account.

Check for newly created privileged users, altered timetable records and unexpected outbound connections.

### Mitigation and prioritisation

Apply a vendor-supported fix or upgrade as soon as available; otherwise remove the application from internet exposure.

Enforce parameterised queries and strict server-side input validation in the affected code path.

Place the service behind a WAF, restrict administrative routes by network or VPN, and use least-privilege database credentials.

Preserve logs and assess database integrity before deployment; use staged testing and a rollback plan because timetable availability is operationally sensitive.

Obtain EPSS, KEV and SSVC status to refine prioritisation and determine whether emergency change procedures are justified.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.