CVE-2026-16486 is a cross-site scripting vulnerability affecting SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists due to insufficient input validation of the 'day' argument in the /BSIS.php file, enabling remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no vendor-provided patch or official remediation level documented. The exploit has been publicly disclosed, increasing the risk of potential attacks.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts via the 'day' parameter. This can lead to the execution of arbitrary scripts in the victim's browser, potentially resulting in session hijacking, defacement, or other client-side attacks. However, the vulnerability does not require privileges or user interaction beyond visiting a crafted URL, and the impact is limited to the confidentiality and integrity of client-side data.

No official patch or remediation guidance is currently available from the vendor. Users of SourceCodester Class and Exam Timetabling System version 1.0 should apply general XSS mitigations such as input validation and output encoding on the 'day' parameter if possible. Monitor vendor channels for updates or patches addressing this vulnerability. Until a fix is released, consider restricting access to the affected functionality or employing web application firewalls to detect and block malicious payloads targeting this parameter.