CVE-2026-16486 in Class and Exam Timetabling System
Summary
by MITRE • 07/22/2026
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the SourceCodester Class and Exam Timetabling System version 1.0, specifically affecting the BSIS.php file where insufficient input validation allows for cross-site scripting attacks through manipulation of the day parameter. The flaw represents a classic injection vulnerability that enables attackers to execute malicious scripts in the context of other users' browsers, potentially compromising user sessions and data confidentiality. This type of vulnerability falls under CWE-79 which categorizes improper neutralization of special elements used in web pages, specifically addressing cross-site scripting flaws that occur when web applications fail to properly validate or escape user-provided input before incorporating it into dynamic web content.
The attack vector is remote and publicly available, meaning any user who accesses the vulnerable system could be targeted without requiring physical access or complex exploitation techniques. The vulnerability's exposure in the BSIS.php file suggests that this particular component handles user input related to day scheduling or timetable management, where the day parameter likely represents a date or weekday selection field. When an attacker manipulates this parameter with malicious script code, the system fails to sanitize the input before rendering it back to users, creating an opportunity for session hijacking, credential theft, or redirection to malicious sites.
The operational impact of this vulnerability extends beyond simple data corruption or availability issues, as XSS attacks can lead to complete compromise of user sessions and potential privilege escalation within the application. Attackers could leverage this flaw to steal cookies containing session tokens, redirect users to phishing sites, or inject malicious content that appears legitimate within the trusted application interface. From an attack framework perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework under the T1059.008 sub-technique for Scripting and T1531 for Establishing Persistence through web-based attacks.
The public exploit availability significantly increases the risk profile of this vulnerability, as it removes the requirement for advanced technical skills to exploit the flaw. Organizations using this system should immediately implement input validation measures, including proper sanitization of all user-supplied parameters before processing or rendering them in web interfaces. The recommended mitigations include implementing Content Security Policy headers, using proper output encoding techniques, and conducting comprehensive input validation that rejects or sanitizes potentially malicious payloads. Additionally, the application should be updated to a newer version if available, as this vulnerability likely represents an issue that has been addressed in subsequent releases of the software.