The vulnerability CVE-2026-90514 affects SourceCodester School Registration and Fee System 1.0. It is a SQL injection issue caused by improper sanitization of the 'Status' parameter in the /bilal/normal/save_stud.php script. This allows an unauthenticated remote attacker to manipulate SQL queries, potentially leading to unauthorized database access or modification. The vulnerability is publicly disclosed with a medium severity rating (CVSS 6.9). No vendor advisory or patch information is available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts. The vulnerability is remotely exploitable without authentication, increasing its risk. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and sanitization on the 'Status' parameter as a temporary mitigation. Monitoring for unusual database activity may also help detect exploitation attempts.