CVE-2026-13488

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0

Description An issue exists in the /preview7.php endpoint where the course year section argument is susceptible to SQL injection, a technique that allows an attacker to interfere with the queries that an application makes to its database. This flaw can be exploited remotely.

Recommendations Update SourceCodester Class and Exam Timetabling System version 1.0 to a version that contains a fix for this issue. As a temporary mitigation, restrict access to the /preview7.php endpoint or avoid using the course year section parameter until a patch is applied.