CVE-2026-13565 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 and 1.php, specifically in the /edit_class1.php file. The vulnerability is triggered by manipulation of the ID parameter, enabling remote attackers to inject SQL commands. The vulnerability is publicly disclosed but no official fix or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification, potentially compromising the confidentiality and integrity of the system's data. However, the impact is rated medium, indicating limited scope or difficulty in exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official patch, users should consider applying input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitor vendor channels for updates or official fixes.