EUVD-2026-45414
GHSA-5frv-67vm-973m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring low-privilege account and victim page view; scope changes as payload runs in victim browser context.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.
AnalysisAI
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the course parameter of /forCYS.php, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Technical ContextAI
The affected application is a PHP-based academic scheduling tool distributed by SourceCodester (sourcecodester.com), identified by CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically a reflected XSS pattern: user-supplied input in the course HTTP parameter is rendered into the HTML response of /forCYS.php without adequate output encoding or sanitization. PHP applications in this category commonly lack framework-enforced escaping (such as that provided by templating engines like Twig or Blade), leaving manual htmlspecialchars() calls as the only defence - which are evidently absent here. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack is network-delivered, low-complexity, requires low privileges, and depends on passive user interaction (a second authenticated user viewing the injected output).
RemediationAI
No vendor-released patch has been identified at time of analysis; the VulDB report and GitHub POC reference do not link to an upstream fix from SourceCodester. Operators should immediately apply output encoding to the course parameter within /forCYS.php - specifically wrapping all user-supplied values rendered into HTML with PHP's htmlspecialchars($value, ENT_QUOTES, 'UTF-8') before output. As a compensating control, a Web Application Firewall (WAF) rule blocking common XSS payloads (script tags, event handlers) on the course parameter can reduce exposure without application changes, though WAF bypasses exist and this is not a substitute for code-level fixes. Additionally, restricting access to the application to trusted internal networks or VPN-only endpoints eliminates the network-remote exploitation vector entirely - the most effective short-term mitigation given the public POC. Monitor VulDB entry https://vuldb.com/vuln/380019 and the SourceCodester product page for any future patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today