CVE-2026-19899 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in an unknown function of the /edit_teacher.php file, where manipulation of the ID parameter can lead to SQL injection. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Public exploit code has been disclosed, but no active exploitation has been reported. No official patch or fix information is provided in the available data.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The vulnerability affects confidentiality, integrity, and availability to a limited extent. Since the attack vector is network-based with no privileges required, the risk is significant but not critical due to the limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the ID parameter in /edit_teacher.php to prevent SQL injection. Monitor for updates from the vendor or trusted security advisories for patches or official mitigations.