CVE-2026-16202
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, allowing XSS in /CYS.php via the course argument. The attack is remotely exploitable and the exploit is public.
Risk Assessment
An attacker can inject malicious scripts, potentially leading to session theft or redirection to a malicious site.
Recommendation
Update the system to the latest version or apply input filtering for the course argument.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /CYS.php. This manipulation of the argument course causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.