The vulnerability CVE-2026-75079 affects SourceCodester Class and Exam Timetabling System 1.0. It is caused by improper sanitization of the ID parameter in the /edit_subject2.php script, allowing an attacker to perform SQL injection. This can lead to unauthorized database queries and potential data compromise. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impact. Public exploit code is available, but no known active exploitation in the wild has been reported.

Successful exploitation of this SQL injection vulnerability can allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the system's data. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk if the system is exposed to untrusted networks.

No official patch or remediation has been provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the vulnerable endpoint, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter, and review input validation and sanitization in the affected script.