CVE-2026-13487 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The issue exists in an unspecified function within /archive.php where the 'sy' parameter is improperly sanitized, allowing remote attackers to inject SQL commands. The vulnerability is remotely exploitable without authentication and has a medium severity rating (CVSS 6.9). No official fix or vendor advisory has been published, and the patch status is currently unknown. Public exploit code exists, increasing the risk of potential exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database privileges. The vulnerability does not require user interaction or privileges to exploit, increasing its risk profile. However, there are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall (WAF) rules to block malicious payloads targeting the 'sy' parameter in /archive.php. Monitor vendor channels for updates and apply patches promptly once released.