The vulnerability CVE-2026-11486 affects SourceCodester Class and Exam Timetabling System 1.0. It is a SQL injection flaw in an unspecified functionality within the /archive1.php file. By manipulating the 'sy' parameter, an attacker can inject SQL commands remotely without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, and no privileges required. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected system. The exact impact depends on the database and application context but may include data disclosure or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the 'sy' parameter.