The vulnerability CVE-2026-10297 affects itsourcecode Fees Management System 1.0. It arises from improper sanitization of the ID argument in the /manage_course.php script, enabling remote attackers to inject SQL commands. This can lead to unauthorized database queries or modifications. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may result in unauthorized data access, data modification, or other database impacts depending on the database privileges of the application. However, the vulnerability is rated medium severity, reflecting limited impact or exploit complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint, applying web application firewall rules to detect and block SQL injection attempts, and reviewing application input validation. No official patch or temporary fix is currently documented.