CVE-2026-90615
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A security vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. It affects an unknown part of /subject1.php, and manipulation of the subject argument leads to cross site scripting. The attack can be executed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can execute scripts in the victim's browser, potentially leading to session or data theft. The public availability of the exploit increases the risk of exploitation.
Recommendation
Implement input validation and encoding in /subject1.php and restrict access to the application. Monitor the project for an official fix.
Other vulnerabilities in Class and Exam Timetabling System
See all- CVE-2026-78055Medium
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIT2.php. Manipulation of the course argument leads to XSS. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-78054Medium
A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.
- CVE-2026-11482High
SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS