CVE Alert: CVE-2026-86298 – SourceCodester

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /delete_subject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

High practical risk for any internet-accessible deployment: publicly available exploit code and unauthenticated remote reachability warrant urgent remediation, although there is no evidence here of active exploitation or KEV/SSVC prioritisation.

An attacker could access or alter timetable and subject data, disrupt administrative workflows, or use the application as an entry point for broader database compromise. Education organisations may face confidentiality, integrity and availability impacts even where the application itself is not business-critical, particularly during enrolment or examination periods. EPSS, KEV and SSVC values are not provided, so the likelihood of widespread exploitation remains uncertain.

### Most likely attack path

The likely path is a direct HTTP request to the vulnerable function using a crafted identifier: AV:N, AC:L, PR:N and UI:N indicate no account, special conditions or victim interaction are required. Scope is unchanged, suggesting impact is initially confined to the application and its database, but stolen credentials or database access could enable subsequent lateral movement into connected systems.

### Who is most exposed

Small schools, colleges and training providers hosting this freeware application on public web servers are most exposed, especially where it shares infrastructure or database services with other applications.

Review web logs for abnormal identifier values and repeated requests to the deletion function.

Alert on database syntax errors, unusual query volume or destructive statements.

Inspect WAF and reverse-proxy events for injection patterns.

Check application and database accounts for unexpected data changes.

Hunt for outbound connections or new files from the web server.

### Mitigation and prioritisation

Apply the strongest available vendor fix immediately; if none exists, replace or remove the application.

Restrict access behind VPN or an allow-list and block the affected function at the WAF.

Use parameterised queries and least-privilege database credentials.

Preserve logs and test mitigations in a staging environment before peak operational periods.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.