CVE-2026-16156 is a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in the /forexam.php file where the 'day' argument is not properly sanitized, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no vendor advisory or patch available at this time, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser session, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and low privileges to exploit, and it does not involve confidentiality or integrity violations directly but may facilitate further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing input validation or output encoding on the 'day' parameter as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.