This vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to perform cross-site scripting by manipulating the 'course' argument in the /BSHRM1.php file. The vulnerability permits injection of malicious scripts that can execute in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability. No official patch or remediation guidance is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of users interacting with the affected system, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and does not impact confidentiality or availability directly. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'course' parameter to mitigate XSS risks. Monitoring for suspicious activity related to this parameter is advised.