CVE-2026-16202 is a cross-site scripting vulnerability found in SourceCodester Class and Exam Timetabling System version 1.0. The issue is located in an unspecified functionality within the /CYS.php file, where manipulation of the 'course' parameter can lead to injection of malicious scripts. This vulnerability can be exploited remotely without requiring elevated privileges, and user interaction is possible but not strictly necessary. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the affected version 1.0 of the product and depends on the victim's interaction with the malicious payload. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or sanitization on the 'course' parameter as a temporary mitigation. Additionally, employing web application firewalls (WAF) to detect and block XSS payloads may reduce risk. Monitor vendor communications for updates regarding an official patch.