CVE-2026-16156 is a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The issue is located in the /forexam.php file where the 'day' argument is not properly sanitized, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. There is no vendor-provided patch or official remediation at this time. Public exploit code is available, which may facilitate exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected web application. The vulnerability requires low attack complexity and no privileges but does require user interaction. The impact is limited to the confidentiality and integrity of the user's session and data within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to apply input validation and output encoding on the 'day' parameter in /forexam.php to mitigate the risk of XSS. Consider employing web application firewalls or other filtering mechanisms to detect and block malicious payloads targeting this parameter.