Is CVE-2026-85512 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85512 being exploited in the wild.

How severe is CVE-2026-85512?

High severity, with a CVSS score of 7.3, published 4 September 2026.

Is there a fix for CVE-2026-85512?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85512 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85512?

Check whether you run SourceCodester Class and Exam Timetabling System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85512: SourceCodester Class and Exam Timetabling System authorization bypass in /admin/session.php

CVE-2026-85512 · Severity: high · CVSS 7.3 · Published 2026-09-04

SourceCodester Class and Exam Timetabling System is a PHP-based application used to manage school class schedules and exam timetables. A missing authorization check in the admin session handling allows attackers to bypass authentication and manipulate the system remotely without valid credentials, potentially compromising schedules, student data, and system integrity.

Technologies: SourceCodester Class and Exam Timetabling System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-85512 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85512 being exploited in the wild.
How severe is CVE-2026-85512?: High severity, with a CVSS score of 7.3, published 4 September 2026.
Which products and versions are affected?: SourceCodester Class and Exam Timetabling System 1.0.
Is there a fix for CVE-2026-85512?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85512 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85512?: Check whether you run SourceCodester Class and Exam Timetabling System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in /admin/session.php where manipulation of the ID parameter bypasses access controls. The flaw allows unauthenticated attackers to access admin functionality remotely without proper session validation or permission checks. Reference materials indicate SQL injection also exists in /modal_add_room1.php via the room_name parameter, suggesting broader input validation issues across the application. No patch has been publicly released; administrators should upgrade from version 1.0 or implement strict input validation and authentication controls.

Affected products

SourceCodester Class and Exam Timetabling System 1.0

Timeline

2026-09-04: disclosed: CVE-2026-85512 published
2026-07-20: other: SQL injection variant reported on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.