The vulnerability allows an attacker to inject malicious scripts into the "course" argument that is processed by the /BSIT2.php page. This injection enables a reflected or stored XSS attack, giving an attacker the ability to run arbitrary JavaScript in the victim’s browser. The exposed weakness corresponds to CWE-79 and, based on the description, the code may also involve the use of eval, related to CWE-94. The consequences include session hijacking, data theft, phishing, or defacement of the web interface, depending on the privileges of the victim and the scope of the application. No remote code execution or other higher‑level impact beyond client‑side script execution has been disclosed.

SourceCodester Class and Exam Timetabling System version 1.0 is affected. No other versions are listed, and the only component referenced is the BSIT2.php script. The affected functionality relies on user input through a "course" parameter, suggesting that any publicly reachable or authenticated instance of the application that permits this parameter could be compromised.

The CVSS score of 5.3 describes a moderate severity vulnerability. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, implying no known mass exploitation or confirmed widespread attacks. Remote exploitation is possible via the user‑supplied parameter in a web request, and because the flaw is a typical XSS, a determined attacker could inject scripts into any user’s browser that visits the affected page.