The vulnerability sits in the handling of the 'day' parameter within the /class.php file of SourceCodester Class and Exam Timetabling System. When an attacker supplies crafted input, arbitrary JavaScript is reflected back into the browser, enabling client‑side code execution. This reflected XSS (CWE‑79) can be exploited remotely by any user interacting with the web application and could lead to session hijacking, defacement, or data exfiltration in the context of authenticated users. The flaw is also a form of code injection (CWE‑94), reinforcing the potential impact of executing malicious code.

The affected product is SourceCodester Class and Exam Timetabling System version 1.0, specifically the vulnerable class.php file that processes the 'day' argument.

The CVSS score of 5.3 indicates a moderate severity. However, the EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The flaw is publicly disclosed and can be triggered remotely, meaning any visitor to the site can exploit it if the version remains unpatched. The risk therefore depends largely on whether the application is exposed to the internet and whether users rely on the 'day' parameter for sensitive operations.