CVE-2026-14732 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in the /edit_exam.php script, where the ID parameter is not properly sanitized, enabling remote attackers to inject malicious SQL code. This can potentially lead to unauthorized data access or manipulation. The vulnerability has a CVSS 4.0 score of 6.9, reflecting a medium risk with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor as of the latest advisory. Public disclosure of the exploit exists, but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, modification, or deletion. The impact is rated medium based on the CVSS score and the nature of SQL injection vulnerabilities. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation. Monitoring for unusual database activity may also help detect exploitation attempts.