CVE-2026-78055
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can inject malicious scripts that execute in the victim's browser, potentially leading to session theft, account takeover, or other malicious actions. The public exploit increases the risk of exploitation.
Recommendation
Update the system to the latest version or apply security patches. Additionally, validate and sanitize input data and use output encoding to prevent XSS.
Other vulnerabilities in Class and Exam Timetabling System
See all- CVE-2026-90615Medium
A security vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. It affects an unknown part of /subject1.php, and manipulation of the subject argument leads to cross site scripting. The attack can be executed remotely and the exploit has been publicly disclosed.
- CVE-2026-78054Medium
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-11482High
SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS