SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in an unspecified function of the /subject.php file. The vulnerability arises from improper sanitization or validation of the 'subject' parameter, allowing an attacker to inject malicious scripts. This can be exploited remotely without privileges or user interaction. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). No official patch or remediation information is currently available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not require privileges or user interaction but does require the victim to access a crafted URL or input. There is no indication of server-side compromise or data breach from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider applying input validation and output encoding on the 'subject' parameter as a temporary mitigation. Monitor vendor channels for updates or patches addressing this vulnerability.