CVE-2026-13566 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists due to insufficient input validation of the course_year_section parameter in the /preview3.php script. An attacker can remotely exploit this flaw by injecting malicious SQL code, potentially compromising the backend database. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has low impact on confidentiality, integrity, and availability. No official remediation or patch has been published as of the vulnerability disclosure date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or parameterized queries as a temporary mitigation to prevent SQL injection via the course_year_section parameter.