CVE-2026-16203
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /forCYS.php file. Manipulation of the course argument allows remote injection of malicious scripts. The exploit is publicly available.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform actions on their behalf, compromising data confidentiality and integrity.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input filtering and validation for the course argument.
Original NVD description (English source)
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.