This vulnerability affects SourceCodester Class and Exam Timetabling System 1.0. It is caused by insufficient input validation or sanitization of the 'course' parameter in the /BSIT2.php file, leading to a cross-site scripting condition. An attacker can exploit this flaw remotely by manipulating the 'course' argument to execute arbitrary scripts in the context of the victim's browser. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser session, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected web application. The impact is limited by the need for user interaction and the absence of elevated privileges required for exploitation.

No official patch or remediation has been published by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and output encoding on the 'course' parameter to mitigate the risk. Monitoring for suspicious activity related to this parameter is advisable.