This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. It arises from improper sanitization of the 'course' parameter in the /BSCE2.php file, allowing an attacker to perform cross-site scripting (XSS) attacks. The attack vector is network-based with no privileges required and no user interaction needed to initiate the attack, but user interaction is required to complete it. The vulnerability does not involve confidentiality, integrity, or availability impacts but can lead to limited integrity impact through script injection. Exploit code is publicly available, but no known exploits are reported in the wild. No official patch or remediation guidance is currently provided by the vendor.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other user-targeted attacks. However, the impact is limited to integrity with no direct confidentiality or availability compromise. The vulnerability requires user interaction to be effective.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the 'course' parameter to mitigate XSS risks. Additionally, applying web application firewalls (WAFs) that detect and block XSS payloads may help reduce exposure.