CVE-2026-11483 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The issue arises from improper sanitization of the 'sy' parameter in the /archive4.php file, enabling remote attackers to inject malicious SQL commands. The vulnerability is rated medium severity with a CVSS 4.0 base score of 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. There is no vendor-provided patch or official remediation at this time. Public exploit code is available, which may facilitate attacks.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, impacting confidentiality, integrity, and availability of the system's data. The medium severity score indicates a significant but not critical impact. No evidence of active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'sy' parameter to mitigate SQL injection risks. Monitoring for unusual database activity and restricting database permissions may also help reduce potential impact.