CVE-2026-16203 identifies a cross-site scripting vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue is located in the /forCYS.php file where the 'course' parameter can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely without requiring privileges or user interaction, leading to potential client-side script execution. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and low impact on confidentiality and integrity. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected web application. This can result in session hijacking, defacement, or redirection to malicious sites. The impact is limited to the client side and does not directly affect server confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'course' parameter in /forCYS.php to mitigate the risk of XSS. Additionally, employing web application firewalls (WAF) to detect and block malicious payloads may help reduce exposure.