Description
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.
Published: 2026-07-19
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the forCYS.php endpoint of SourceCodester Class and Exam Timetabling System allows an attacker to insert arbitrary JavaScript by manipulating the 'course' query parameter. The injected script runs in the victim’s browser, enabling cookie theft, session hijacking, phishing attacks or defacement. The weakness is a classic CWE‑79 injection, and its effects are limited to the client side, typically impacting confidentiality and integrity of user data, while potentially disrupting user experience.

Affected Systems

The affected product is SourceCodester Class and Exam Timetabling System version 1.0 as distributed by SourceCodester.

Risk and Exploitability

The CVSS score of 5.1 signals a moderate severity, and the EPSS score of less than 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by directing victims to a crafted link that includes a malicious 'course' value; no server‑side compromise is required and the exploit is publicly documented.

Generated by OpenCVE AI on July 30, 2026 at 22:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest vendor release that includes input validation or encoding for the 'course' parameter.
  • If a patch is unavailable, modify the source code locally to sanitize the 'course' input before rendering it.
  • Deploy a web application firewall rule to detect and block script execution attempts in the 'course' query parameter.

Generated by OpenCVE AI on July 30, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 19 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.
Title SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester class And Exam Timetabling System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester class And Exam Timetabling System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Class And Exam Timetabling System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:43:59.386Z

Reserved: 2026-07-18T07:32:44.673Z

Link: CVE-2026-16203

cve-icon Vulnrichment

Updated: 2026-07-20T13:42:52.936Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')