CVE-2026-75079 is an unauthenticated SQL injection vulnerability in SourceCodester educational timetabling software, assigned CVSS 7.3. The technical severity is accurate—remote attackers can extract arbitrary data from the underlying database without credentials. But the CVSS score tells you almost nothing about the actual risk distribution, and the EPSS probability of 0.00263 is actively misleading for this CVE class.
SourceCodester PHP projects are downloaded primarily by small schools, community colleges, and individual developers who need functional software without enterprise licensing costs. These deployments run on under-resourced servers, often with no dedicated IT security team, no vulnerability monitoring, and no subscription to NVD feeds. There is no security contact, no patch pipeline, and in many cases, no one at the institution who knows this code is running. The CVE disclosure assumes a recipient somewhere who will triage and patch. For SourceCodester deployments, that recipient doesn't exist.
The EPSS model estimates opportunistic scanning based on deployment telemetry that doesn't exist for this software category—there's no Shodan fingerprint, no systematic scanning data, no incident reporting from this population. What EPSS interprets as low exploitation probability is actually absence of signal. The real threat isn't automated scanning; it's targeted discovery by anyone who knows the software footprint and searches for it.
Once compromised, the blast radius extends well beyond the database. These deployments typically run on unsegmented networks with no EDR, no logging, and reused credentials. The database contains student PII, grades, personal information—everything a fully compromised system can expose. The SQL injection is a beachhead, not a terminal event.
If you're responsible for defending an environment running SourceCodester timetabling or any SourceCodester PHP project: assume the system is already compromised if it's internet-facing. Disconnect it from any network segment containing sensitive data. Identify any credentials or API keys stored in the database that might grant further access. The exposure window here isn't measured in days—it's measured in how long this code has been deployed without the institution knowing it existed.