CVE-2026-13521

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0

Description A remote SQL injection exists in the /preview5.php endpoint. This issue occurs when the course year section variable is manipulated, allowing an attacker to interfere with the database queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the course year section parameter in the /preview5.php endpoint until the issue is resolved.