CVE-2026-14641 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The issue exists in an unspecified functionality within the /edit_course.php file, where manipulation of the ID argument can lead to injection of malicious SQL code. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the remediation level is unknown.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and validate or sanitize input parameters to mitigate SQL injection risks.