CVE-2026-13486 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0, specifically in the /preview6.php file. The vulnerability arises from improper sanitization of the course_year_section parameter, allowing remote attackers to inject SQL commands. This can lead to partial compromise of confidentiality, integrity, and availability of the system's data. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (medium severity). No official fix or vendor advisory is currently available, and the vulnerability details have been publicly disclosed.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may result in unauthorized reading, modification, or deletion of data, impacting the confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, no known active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to implement input validation and sanitization on the course_year_section parameter to mitigate injection risks. Monitoring for unusual database activity and restricting database permissions may also reduce impact. Avoid exposing the vulnerable endpoint publicly if possible.