CVE-2026-13487 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The issue arises from improper sanitization of the 'sy' argument in the /archive.php file, allowing remote attackers to inject malicious SQL commands. This can lead to unauthorized access or modification of the backend database. The vulnerability is remotely exploitable without authentication and has a medium severity rating based on CVSS 4.0 metrics. No official fix or vendor advisory is currently available, and the patch status is unknown.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database-related impacts. The vulnerability is remotely exploitable without authentication and requires no user interaction. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate SQL injection risks related to the 'sy' parameter in /archive.php. Monitor for vendor updates regarding patches or official mitigations.