CVE-2026-15595

SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Analysis

AI-generated

Technical impact

The flaw is a reflected cross‑site scripting vulnerability in /forsubject.php. By altering the subject argument, an attacker can inject arbitrary JavaScript that executes when a user views the page. This injection exploits the lack of input validation and allows client‑side code to run in the context of the victim's session.

Affected Systems

The affected product is SourceCodester Class and Exam Timetabling System, version 1.0, distributed by SourceCodester. No other versions or product modules are listed in the advisory.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability in the moderate range, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can remotely trigger the injection by crafting a URL or submitting a form that contains a malicious payload in the subject field, but the description does not specify whether authentication is required.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a fixed version when it becomes available.
  • Validate and sanitize the subject request parameter on the server side, encoding any output to prevent execution of injected scripts (addresses CWE‑79).
  • Implement a strict Content Security Policy that disallows inline scripts and limits script sources to trusted domains to mitigate the impact of any remaining injection vectors.

Generated by OpenCVE AI on August 3, 2026 at 03:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 1:03 PM
Reserved
Jul 13, 2026, 2:02 PM

View source JSON

Updated
Jul 14, 2026, 1:02 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 9:16 PM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 3, 2026, 3:45 AM

JSON