CVE-2026-15595
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /forsubject.php. An unknown function mishandles the subject argument, allowing injection of malicious scripts. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
The risk involves potential execution of arbitrary JavaScript in users' browsers, which could lead to session theft, account takeover, or leakage of sensitive data.
Recommendation
Immediately update the system to the latest version or apply a security patch. If not possible, temporarily disable access to /forsubject.php and thoroughly sanitize the subject argument input.
Other vulnerabilities in SourceCodester Class and Exam Timetabling System
See all- CVE-2026-13565High
In SourceCodester Class and Exam Timetabling System 1.0, the file /edit_class1.php is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-78115Medium
A vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the file /admin/edit_user_account.php (User Account Update component) allows manipulation of the id/username argument, leading to improper authorization. The attack may be launched remotely.
- CVE-2026-75080High
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject1.php. Manipulation of the argument ID leads to SQL injection. The attack can be carried out remotely and the exploit has been disclosed publicly.
- CVE-2026-75079High
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject2.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-75078Medium
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. It affects an unknown part of the file /BSHRM1.php. Manipulation of the argument course results in cross site scripting. Remote exploitation is possible, and the exploit is publicly available.
- CVE-2026-75077Medium
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. It affects some unknown functionality of the file /BSCE2.php. Manipulation of the argument course leads to cross site scripting. The attack may be launched remotely, and the exploit is publicly available.
- CVE-2026-19899High
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, where SQL injection in /edit_teacher.php via the ID argument can lead to SQL injection. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-16486Medium
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS.php. Manipulation of the day argument results in cross-site scripting. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-16485Medium
In SourceCodester Class and Exam Timetabling System 1.0, an unknown functionality in /class.php is vulnerable to cross-site scripting (XSS) via the day argument. Remote exploitation is possible and the exploit is public.
- CVE-2026-16484High
SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL Injection in the file /edit_subjecta.php via manipulation of the ID argument. The attack can be performed remotely.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.