{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asourcecodesterclass_and_exam_timetabling_system1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-85512"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Class and Exam Timetabling System (1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eSourceCodester Class and Exam Timetabling System version 1.0 contains a critical missing authorization vulnerability identified as CVE-2026-85512. The flaw resides within the /admin/session.php file, where the ID argument is insufficiently validated. This vulnerability allows remote, unauthenticated attackers to bypass access controls and perform actions intended for administrative users. With exploit code currently available in the public domain, this vulnerability poses a significant risk to any organization deploying this specific version of the system. Defenders should prioritize identifying instances of this software within their environments and restricting access to administrative endpoints while awaiting a vendor patch or remediation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass authorization, potentially leading to unauthorized data access, system configuration changes, or full administrative compromise of the affected Class and Exam Timetabling System instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit network assets to identify instances of SourceCodester Class and Exam Timetabling System version 1.0.\u003c/li\u003e\n\u003cli\u003eRestrict access to the /admin/ directory and session.php files to trusted administrative IP addresses via firewall rules.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous GET or POST requests targeting /admin/session.php containing manipulated ID parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-04T11:25:24Z","date_published":"2026-09-04T11:25:24Z","id":"https://feed.craftedsignal.io/briefs/2026-09-class-exam-timetabling-auth-bypass/","summary":"SourceCodester Class and Exam Timetabling System version 1.0 is vulnerable to a remote authorization bypass via the ID argument in /admin/session.php, enabling unauthenticated access to administrative functions.","title":"Authorization Bypass in SourceCodester Class and Exam Timetabling System","url":"https://feed.craftedsignal.io/briefs/2026-09-class-exam-timetabling-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}