Description
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote cross‑site scripting flaw exists in the exam.php file of SourceCodester Class and Exam Timetabling System. Attacking the "day" argument allows insertion of arbitrary JavaScript that executes in the context of viewing users. The flaw permits the execution of user‑controlled scripts during a user’s session.

Affected Systems

SourceCodester Class and Exam Timetabling System version 1.0. No newer versions or update information is listed in the advisory.

Risk and Exploitability

The CVSS base score is 5.3, denoting a moderate risk level. The EPSS score is below 1%, indicating that public exploitation is presently unlikely. The issue is not listed in CISA’s KEV catalog. The vulnerability can be triggered through a standard HTTP request from a remote location, requiring only the ability to manipulate the "day" parameter.

Generated by OpenCVE AI on July 31, 2026 at 05:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an official update or patch if one is available for SourceCodester Class and Exam Timetabling System.
  • Validate the "day" parameter on the server side to allow only expected numeric values or a restricted set of dates.
  • Sanitize or encode all output that includes user input, or implement a content security policy to mitigate script execution.

Generated by OpenCVE AI on July 31, 2026 at 05:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Title SourceCodester Class and Exam Timetabling System exam.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T19:51:21.035Z

Reserved: 2026-07-14T10:40:56.375Z

Link: CVE-2026-15715

cve-icon Vulnrichment

Updated: 2026-07-14T19:42:00.703Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T06:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')