Is there a public PoC exploit available for EUVD-2026-44324?

Yes, a public proof-of-concept exploit is available for EUVD-2026-44324. Prioritise patching immediately. EPSS: 0.4%.

Class and Exam Timetabling System EUVD-2026-44324

Q: What is the CVSS score of EUVD-2026-44324?

EUVD-2026-44324 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-15715 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 VulDB

GHSA-4c9r-jxqx-6hxv

PHP XSS Class And Exam Timetabling System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Reflected XSS requires victim interaction (UI:R); scope changes to victim browser (S:C); no availability impact; no auth required per CVSS 4.0 PR:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 15:32 vuln.today

Severity Changed

Jul 14, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

Jul 14, 2026 - 18:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 14, 2026 - 17:45 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the day parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.

Technical ContextAI

The affected application is a PHP-based academic scheduling tool distributed by SourceCodester (CPE: cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the day query parameter accepted by /exam.php is reflected into the HTML response without adequate output encoding or sanitization. This is a classic reflected XSS pattern where attacker-controlled input travels from URL to page rendering in the same request cycle, requiring the victim to be induced into following a crafted link. The PHP tag in the intelligence data confirms the server-side language; browser-side execution occurs when the victim's browser parses and evaluates the injected script.

RemediationAI

No vendor-released patch has been identified at the time of analysis; patch availability is not confirmed from the provided references or vendor advisory. Operators running this application should apply output encoding to the day parameter before rendering it in HTML responses in /exam.php - specifically HTML entity encoding (e.g., using PHP's htmlspecialchars() with ENT_QUOTES) to neutralize script injection. Deploying a Content Security Policy (CSP) header that restricts script sources to self can reduce XSS impact even if the input flaw persists, though this is a mitigation, not a fix. Restricting access to the application via network controls (IP allowlisting, VPN-only access) would prevent remote exploitation entirely and is the most effective compensating control given the application's educational niche. The VulDB entry and POC reference are available at https://vuldb.com/vuln/378291 and https://github.com/AlbaDove/cve/issues/7 for operator review.