CVE-2026-15595 identifies a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue is located in an unspecified function within the /forsubject.php file, where manipulation of the 'subject' parameter enables injection of malicious scripts. The vulnerability can be exploited remotely without privileges or user interaction, leading to potential script execution in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality or availability impact, and low integrity impact. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users interacting with the affected system. This can result in session hijacking, defacement, or redirection to malicious sites. However, the impact is limited to integrity and user interaction is required for exploitation. There is no known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'subject' parameter in /forsubject.php to mitigate XSS risks. Monitoring for updates from SourceCodester is recommended.