CVE-2026-13566 describes a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability exists in the /preview3.php script where the course_year_section argument is not properly sanitized, enabling attackers to execute arbitrary SQL queries remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor-provided patch or official remediation information available at this time. Exploit code is publicly available, but no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector components (VC:L, VI:L, VA:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the course_year_section parameter.