CVE-2026-14642 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The issue exists in the /edit_class2.php file where the ID argument is not properly sanitized, enabling remote attackers to inject malicious SQL commands. The vulnerability is exploitable remotely without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. The vulnerability affects the confidentiality, integrity, and availability of the system to a limited extent as indicated by the CVSS vector. However, no confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the ID parameter in /edit_class2.php to prevent SQL injection. Monitor vendor channels for updates or patches addressing this vulnerability.