CVE-2026-15715

Deferred Deferred - Pending Action

Cross-Site Scripting in Class and Exam Timetabling System

Publication date: 2026-07-14

Last updated on: 2026-07-14

Assigner: VulDB

Description

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-14

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15715

EUVD

EUVD-2026-44324

Affected Vendors & Products

Vendor	Product	Version / Range
sourcecodester	class_and_exam_timetabling_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in the Class and Exam Timetabling System 1.0. It affects the /exam.php file where the 'day' parameter is improperly validated and encoded. Attackers can inject malicious scripts via this parameter, which executes in a victim's browser without needing authentication.

Detection Guidance

To detect this XSS vulnerability in the Class and Exam Timetabling System, inspect HTTP requests to /exam.php for the 'day' parameter. Look for payloads like <script>alert(1)</script> in the parameter value. Use tools like curl to send test requests: curl 'http://target/exam.php?day=<script>alert(1)</script>'

Check web server logs for unusual input in the 'day' parameter. Browser developer tools can also help identify unsanitized input reflected in the page output.

Impact Analysis

An attacker could steal sensitive data like session cookies or tokens, perform unauthorized actions on your behalf, deface web pages, or redirect you to malicious sites. Since no login is required, any user visiting the affected page is at risk.

Compliance Impact

This XSS flaw could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately apply input validation to the 'day' parameter in /exam.php to reject malicious scripts. Implement output encoding to escape HTML special characters before rendering user input.

Add a Content Security Policy (CSP) header to restrict inline scripts. Set secure and HttpOnly flags for cookies to mitigate session hijacking risks. Update to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-15715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70