CVE-2026-13526 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The issue is located in an unspecified function within the /edit_class.php file, where the ID argument is not properly sanitized, enabling remote attackers to inject malicious SQL commands. This vulnerability can be exploited without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low integrity and availability impacts. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited integrity and availability impact. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality, applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter, and reviewing database permissions to minimize potential damage from exploitation.