EUVD-2026-45413
GHSA-grp8-2555-3cmp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring low-privilege auth (PR:L) and victim interaction (UI:R), with scope change to victim browser (S:C) enabling confidentiality and integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /CYS.php. This manipulation of the argument course causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the course argument in /CYS.php, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Technical ContextAI
The affected product is a PHP-based academic scheduling application distributed by SourceCodester, identified by CPE cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input to the course parameter in the /CYS.php endpoint is rendered into the HTML response without adequate sanitization or output encoding. This is a classic reflected or stored XSS pattern in a PHP web application where unsanitized GET/POST parameters are echoed directly into the DOM, enabling script injection in the victim's browser session.
RemediationAI
No vendor-released patch has been identified at time of analysis. SourceCodester was not found to have issued a security advisory or updated release. As compensating controls, administrators should restrict access to /CYS.php to authenticated and trusted internal users only via server-level access controls (e.g., IP allowlisting or HTTP authentication at the web server layer), which limits exploitation to insider threats. Deploying a web application firewall (WAF) rule to block script-bearing payloads in the course parameter provides an additional layer, though WAF bypass is possible for a determined attacker. Input validation and output encoding should be applied server-side to the course parameter - specifically, PHP's htmlspecialchars() with ENT_QUOTES encoding before rendering into HTML. For the public exploit, see https://github.com/AlbaDove/cve/issues/9 and VulDB entry https://vuldb.com/vuln/380018.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today