EUVD-2026-45403
GHSA-384v-9jpc-7qvm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable XSS requiring low-privilege auth and victim interaction; scope changed as payload executes in victim browser origin.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the argument day results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the day parameter of /forexam.php, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Technical ContextAI
The affected application is a PHP-based academic scheduling tool distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*), commonly used as a student project or small-institution utility. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the day GET or POST parameter passed to /forexam.php is reflected into the HTML response without adequate encoding or sanitization. This class of flaw allows an attacker to embed arbitrary JavaScript in the rendered page, which then executes under the origin of the vulnerable server in the victim's browser context. The CPE wildcard on version suggests NVD has not pinned a patched version, implying the flaw exists across all known releases of this application.
RemediationAI
No vendor-released patch has been identified at time of analysis. As a primary compensating control, administrators should sanitize and HTML-encode all user-supplied input before reflecting it in server responses, specifically the day parameter in /forexam.php; this requires a code-level fix in the PHP source. Deploying a Web Application Firewall (WAF) with XSS filtering rules can block common exploit payloads without altering application logic, though WAF bypass techniques exist and this is not a permanent fix. Implementing a strict Content Security Policy (CSP) header (Content-Security-Policy: default-src 'self') can prevent injected scripts from executing in victim browsers; however, this may break legitimate inline scripts in the application and requires testing. Restricting access to /forexam.php to trusted internal networks via network-layer controls reduces external attack surface. For reference, the VulDB advisory is at https://vuldb.com/vuln/379921 and the public exploit is documented at https://github.com/justconter/cve/issues/3.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today