CVE-2026-78055
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session theft, account takeover, or other malicious actions. The public exploit increases the risk of exploitation.
Recommendation
Update the system to the latest version or apply security patches. Additionally, validate and sanitize input data and use output encoding to prevent XSS.
Other vulnerabilities in Class and Exam Timetabling System
See all- CVE-2026-78054Medium
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-11482High
SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.