A defect in the handling of the "course" argument inside the BSIS1.php file allows an attacker to inject arbitrary client‑side script into the response. The flaw is a reflected cross‑site scripting bug (CWE‑79) that also potentially permits execution of server‑side code through the same parameter (CWE‑94). Because the injected script runs in the victim’s browser, it can compromise user credentials or session state, leading to account hijack or data exfiltration, while the underlying system itself remains unchanged.

The vulnerability affects SourceCodester Class and Exam Timetabling System version 1.0. No other product versions are listed, and the specific function within BSIS1.php that is impacted is unnamed in the advisory.

The CVSS score of 5.3 indicates a medium severity, and although the EPSS score is not available, the fact that the exploit code is publicly available suggests that attackers could readily target exposed instances. Because the flaw is remotely exploitable via an HTTP request containing a crafted "course" parameter and is not listed in the CISA KEV catalog, the likelihood of exploitation remains moderate but should not be underestimated, especially for web sites that allow public access.