CVE-2026-16155 identifies a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in the /schoolyr.php file where the 'sy' parameter can be manipulated to execute arbitrary scripts in the context of the victim's browser. The attack can be initiated remotely and the exploit code is publicly available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of users visiting the affected system, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the confidentiality and integrity of the user session with no direct impact on availability or system control indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and output encoding on the 'sy' parameter to mitigate exploitation. Additionally, applying web application firewalls (WAF) rules to detect and block XSS payloads may reduce risk.