CVE-2026-16228 identifies a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in an unspecified function within the /edit_schoolyr.php file, where manipulation of the ID argument can lead to injection of malicious SQL code. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is provided, and no known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is remotely exploitable without user interaction or privileges, increasing the risk of compromise. However, the impact is rated medium due to limited information on the extent of data exposure or control gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts.