A flaw in the /BSHRM1.php script of SourceCodester Class and Exam Timetabling System allows an attacker to inject arbitrary script code by manipulating the course argument. The injected code is executed within the victim's browser, enabling session hijacking, defacement, or other client‑side attacks. Because the vulnerability is triggered via a public request parameter, an attacker with internet access can trigger it from anywhere, making the issue a remote cross‑site scripting (XSS) vulnerability.

The vulnerability affects SourceCodester Class and Exam Timetabling System version 1.0. No other versions or sub‑components are explicitly cited as affected, but the problem resides in an unknown part of the file /BSHRM1.php, which is part of the core application code contained in the source package.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been observed in large‑scale exploits. Nonetheless, the public release of an exploit and the remote nature of the attack vector mean that the risk to any deployed instance can be significant, especially if users are permitted to input arbitrary values for the course argument.