Description
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Published: 2026-07-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs in the unknown function of /subject.php when the subject argument is supplied. An attacker can insert malicious JavaScript that is rendered by the victim’s browser, resulting in a client‑side code injection flaw. This flaw is consistent with CWE‑79 and also involves code generation identified as CWE‑94. The flaw is exploitable remotely by sending a crafted HTTP request, and the exploit code is publicly available.

Affected Systems

The affected product is SourceCodester Class and Exam Timetabling System version 1.0. It is present in the default distribution and no other versions are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is lower than 1 % and the vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the web application can exploit the flaw by including malicious content in the subject parameter; no special prerequisites are required beyond network access.

Generated by OpenCVE AI on July 31, 2026 at 11:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official vendor patch or upgrade to a version that fixes the XSS flaw.
  • Validate the subject parameter against a strict whitelist of allowed characters and encode the input before rendering it in the HTML response.
  • Use context‑aware output escaping or JavaScript encoding to ensure that any remaining user data cannot be executed as script code.

Generated by OpenCVE AI on July 31, 2026 at 11:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /subject.php. Such manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Title SourceCodester Class and Exam Timetabling System subject.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T14:23:52.386Z

Reserved: 2026-07-13T14:02:39.572Z

Link: CVE-2026-15596

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:30:05Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')