CVE-2026-15715 is a cross-site scripting vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The issue arises from improper sanitization of the 'day' parameter in the /exam.php file, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected web application. The vulnerability requires user interaction (UI:P) and has no privileges required (PR:N). The attack complexity is low (AC:L), and no confidentiality, integrity, or availability impact is indicated beyond the XSS itself. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability can lead to execution of malicious scripts in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other client-side attacks. However, the impact is limited to the client side and does not directly affect server confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'day' parameter as a temporary mitigation. Additionally, employing web application firewalls (WAFs) that detect and block XSS payloads may help reduce risk.