This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. It arises from improper sanitization of the 'course' parameter in the /BSCE2.php file, enabling cross-site scripting attacks. The flaw allows remote attackers to inject and execute arbitrary scripts in the context of the victim's browser. The CVSS v3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on integrity. Exploit code is publicly available, but no known active exploitation in the wild has been reported.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially enabling theft of cookies, session tokens, or other sensitive information accessible to the browser. The impact is limited to the confidentiality and integrity of the user's interaction with the affected system. There is no indication of direct impact on system availability or server-side integrity.

No official patch or remediation is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block malicious input targeting the 'course' parameter may reduce risk. Avoiding use of the vulnerable functionality or restricting access to trusted users could also mitigate exposure.