CVE-2026-75077 is a cross-site scripting (CWE-79) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The issue is located in the /BSCE2.php file where manipulation of the 'course' parameter leads to XSS. The vulnerability can be exploited remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 4.3 (low), reflecting limited impact on integrity only, with no confidentiality or availability impact. Public exploit code exists, but no known active exploitation in the wild is reported. No patch or remediation information is currently available.

The vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the 'course' parameter in /BSCE2.php. This can lead to limited integrity impact such as script execution in the context of the victim's browser. There is no impact on confidentiality or availability. The attack requires user interaction (UI:R) and can be launched remotely without privileges (AV:N, PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted input in the affected system. Consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the 'course' parameter. Monitor vendor channels for official patches or updates.