SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in the /BSHRM1.php file. The issue arises from improper sanitization of the 'course' parameter, enabling an attacker to inject malicious scripts that execute in the context of the victim's browser. The vulnerability is remotely exploitable without privileges and requires user interaction. Public exploit code is available, increasing the risk of attacks.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability requires user interaction and does not involve privilege escalation or system compromise directly.

No official patch or remediation has been provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply input validation and output encoding on the 'course' parameter to mitigate XSS risks.