CVE-2026-15597 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System affecting version 1.0 and the 2.php file. The flaw exists in the /edit_exam2.php file where the ID parameter is not properly sanitized, enabling remote attackers to perform SQL injection. This vulnerability is publicly known but no vendor-provided fix or mitigation has been documented. The CVSS 4.0 base score is 6.9, indicating a medium severity risk with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access or modification. However, the impact is rated as medium with limited confidentiality, integrity, and availability impact according to the CVSS vector. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing input validation and parameterized queries for the ID parameter in /edit_exam2.php to mitigate SQL injection risks. Monitoring for updates from SourceCodester is recommended.