Is there a public PoC exploit available for CVE-2026-15595?

Yes, a public proof-of-concept exploit is available for CVE-2026-15595. Prioritise patching immediately. EPSS: 0.3%.

Timetabling System CVE-2026-15595

Q: What is the CVSS score of CVE-2026-15595?

CVE-2026-15595 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 VulDB

PHP XSS Class And Exam Timetabling System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS requires user interaction (UI:R), changes scope to browser (S:C), and enables session theft (C:L) and content manipulation (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 21:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 21:02 vuln.today

CVE Published

Jul 13, 2026 - 20:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized subject parameter in /forsubject.php. A victim user must interact with a crafted URL for the payload to execute in their browser. A public proof-of-concept exploit is available on GitHub, increasing the likelihood of opportunistic exploitation against deployed instances.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting') identifies the root cause: the subject parameter passed to /forsubject.php is reflected into HTML output without adequate escaping or sanitization. This is consistent with typical PHP applications that lack centralized output encoding. The attack surface is the web application's HTTP layer, accessible from any network-reachable client. The CVSS 4.0 E:P metric confirms proof-of-concept code has been published.

RemediationAI

No vendor-released patch or updated version has been identified at the time of this analysis - patch status is unconfirmed, and no official advisory was located at the SourceCodester site. The primary remediation for operators is to apply output encoding to the subject parameter before rendering it in HTML responses (e.g., using PHP's htmlspecialchars() with ENT_QUOTES), and to validate or sanitize all user-supplied input server-side. As a compensating control, deploying a Content Security Policy (CSP) header that restricts inline script execution will substantially reduce exploitability even if the underlying flaw persists - note this may break legitimate inline scripts if present. Restricting access to the application to trusted internal networks or requiring authentication before accessing /forsubject.php would eliminate remote unauthenticated exploitation entirely but requires architectural changes. Reference the public PoC at https://github.com/AlbaDove/cve/issues/6 to reproduce and verify any fix applied.