CVE-2026-14770 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in an unspecified function within /edit_room.php, where manipulation of the ID argument enables injection of malicious SQL commands. The vulnerability is remotely exploitable without authentication or user interaction, with low complexity and limited scope impact. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official fix or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database via the ID parameter in /edit_room.php. This can lead to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impact as per the CVSS 4.0 vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable endpoint, implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter, and reviewing application code for proper input validation and parameterized queries.