This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject malicious scripts via the 'subject' parameter in /subject.php, resulting in cross-site scripting. The vulnerability requires no privileges and no authentication but does require user interaction to exploit. No official patch or remediation guidance is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not grant direct system access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply web application firewalls or input validation controls to filter malicious input on the 'subject' parameter. Avoid clicking on suspicious links that may exploit this vulnerability.