CVE-2026-15595: Class Timetabling System XSS Vulnerability

CVE-2026-15595 Overview

CVE-2026-15595 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /forsubject.php endpoint, where the subject parameter is rendered without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that, once clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Public disclosure of exploitation details has occurred through third-party vulnerability databases.

Critical Impact
Attackers can inject arbitrary script into the browser context of any user who visits a crafted URL, enabling session data theft, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable component is /forsubject.php
The vulnerable parameter is subject

Discovery Timeline

2026-07-13 - CVE-2026-15595 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15595

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Class and Exam Timetabling System, a PHP-based web application distributed through SourceCodester. The /forsubject.php script accepts the subject request parameter and reflects its value into the HTML response without contextual escaping or input sanitization. Because the application returns the attacker-controlled string inside the served document, a browser interprets script payloads embedded in the parameter as executable code.

Exploitation requires user interaction: a victim must load a URL crafted by the attacker. Once triggered, the payload executes with the origin of the vulnerable application, giving the attacker access to cookies not protected by HttpOnly, DOM contents, and any authenticated session state held by the user. The EPSS score for this issue is 0.278%, indicating a low predicted exploitation rate in the near term.

Root Cause

The root cause is missing output encoding on user-controlled input rendered into an HTML context. The subject parameter arrives via an HTTP GET or POST request and is written directly into the response body. Without functions such as htmlspecialchars() or a templating engine that auto-escapes variables, meta-characters like <, >, and " remain intact and terminate the surrounding HTML structure.

Attack Vector

An unauthenticated attacker constructs a URL targeting /forsubject.php with a JavaScript payload placed in the subject parameter. The attacker then delivers the URL through phishing email, chat, or a malicious web page. When an authenticated administrator or user opens the link, the injected script executes in their browser and can perform actions on their behalf against the timetabling application.

The vulnerability mechanism is described in the GitHub issue disclosure and the VulDB vulnerability record. No verified proof-of-concept code is reproduced here; refer to the linked advisories for technical detail.

Detection Methods for CVE-2026-15595

Indicators of Compromise

HTTP requests to /forsubject.php where the subject parameter contains HTML tags, <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E
Web server access logs showing anomalous referrers or externally-hosted URLs directing users to /forsubject.php with long or encoded query strings
Browser console errors or unexpected outbound requests from user sessions to unknown domains after visiting the timetabling application

Detection Strategies

Deploy a web application firewall rule set that inspects the subject parameter for HTML and script metacharacters before requests reach the PHP handler
Enable verbose HTTP request logging on the web server and alert on query strings exceeding a defined length threshold or containing <, >, or %3C
Correlate authentication events with access to /forsubject.php to identify sessions that may have been abused following XSS delivery

Monitoring Recommendations

Ingest web server and WAF logs into a centralized logging platform and build alerts for pattern matches on known XSS payloads targeting the vulnerable endpoint
Monitor for outbound HTTP requests from user workstations to domains not previously observed, especially those correlated in time with visits to the timetabling application
Track user reports of unexpected pop-ups, redirects, or authentication prompts originating from the application

How to Mitigate CVE-2026-15595

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted internal networks or behind a VPN until a fix is deployed
Deploy WAF rules that block requests to /forsubject.php containing script tags, event handlers, or encoded HTML meta-characters in the subject parameter
Instruct users to avoid clicking untrusted links referencing the timetabling application and to report suspicious URLs

Patch Information

At the time of publication, no official vendor patch is listed for SourceCodester Class and Exam Timetabling System 1.0. Administrators should monitor the SourceCodester project page and the VulDB entry for CVE-2026-15595 for remediation updates. Where source code access is available, apply htmlspecialchars($_GET['subject'], ENT_QUOTES, 'UTF-8') before echoing the parameter and validate input against an allow-list of expected values.

Workarounds

Add a Content-Security-Policy header restricting inline scripts and limiting script sources to trusted origins to reduce the impact of successful injection
Set the HttpOnly and Secure flags on session cookies to prevent JavaScript access and transmission over cleartext channels
Apply a reverse proxy filter that rejects requests to /forsubject.php when the subject parameter fails a strict alphanumeric validation check

bash

# Example nginx rule to block script-like payloads in the subject parameter
location = /forsubject.php {
    if ($arg_subject ~* "(<|%3C|script|onerror|onload|javascript:)") {
        return 403;
    }
    proxy_pass http://backend;
}