CVE-2026-78054
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.
Risk Assessment
Similar to CVE-2026-78055, an attacker can exploit XSS to execute malicious scripts in the victim's browser, potentially leading to data theft or session hijacking. The public exploit increases the risk.
Recommendation
It is recommended to update the system and implement input validation and sanitization mechanisms. Also, apply security headers such as Content-Security-Policy to mitigate XSS impacts.
Other vulnerabilities in Class and Exam Timetabling System
See all- CVE-2026-78055Medium
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-11482High
SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation of the argument course can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.