SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in the /class.php file. The vulnerability arises from improper sanitization of the 'day' argument, allowing remote attackers to inject and execute arbitrary scripts in the context of the victim's browser. The attack vector is network-based with no privileges required and user interaction is necessary. The vulnerability has been publicly disclosed but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of users visiting the affected application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the confidentiality and integrity of the user's interaction with the application. There is no indication of privilege escalation or direct impact on the server or backend systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'day' parameter in /class.php to mitigate the risk. Additionally, deploying web application firewalls (WAFs) with XSS protection rules may help reduce exposure. Monitor vendor channels for updates and patches.