CVE-2026-15596: Class and Exam Timetabling XSS Flaw

CVE-2026-15596 Overview

CVE-2026-15596 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /subject.php script, where the subject argument is not properly sanitized before being reflected in application output. Attackers can exploit the issue remotely without authentication, though the attack requires user interaction such as clicking a crafted link. A public exploit exists, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of victims interacting with a crafted URL, enabling session theft, credential harvesting, and defacement of the timetabling interface.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Component: /subject.php
Vulnerable parameter: subject

Discovery Timeline

2026-07-13 - CVE-2026-15596 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15596

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the /subject.php endpoint of the Class and Exam Timetabling System. User-supplied data passed through the subject parameter is written into the HTTP response without proper output encoding or input validation. When a victim loads a URL containing an attacker-controlled payload, the browser interprets the injected content as executable script within the application's origin.

Because the payload executes in the context of the vulnerable web application, attackers can access session cookies, perform actions on behalf of the victim, and manipulate rendered content. The vulnerability requires user interaction, typically through a phishing link or embedded resource. No authentication is needed to craft or deliver the payload.

Root Cause

The root cause is missing neutralization of special characters in the subject parameter before it is echoed back into the HTML response. The application does not apply contextual output encoding such as HTML entity escaping, nor does it enforce a strict Content Security Policy that would restrict inline script execution.

Attack Vector

Exploitation occurs over the network. An attacker crafts a URL to /subject.php containing a malicious subject value with JavaScript payload characters such as <script> tags or event handler attributes. The attacker delivers the URL through phishing, social media, or embedded iframes. When an authenticated user of the timetabling system visits the link, the script executes in their browser session and can exfiltrate cookies or perform authenticated actions.

No verified proof-of-concept code is reproduced here. Refer to the GitHub Issue Report and the VulDB Vulnerability Details for technical write-ups.

Detection Methods for CVE-2026-15596

Indicators of Compromise

HTTP requests to /subject.php containing script tags, javascript: URIs, or event handler attributes such as onerror= and onload= within the subject parameter
URL-encoded payload fragments such as %3Cscript%3E or %3Cimg observed in web server access logs
Unusual outbound requests from user browsers to attacker-controlled domains following visits to timetabling URLs

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string parameters for common XSS payload signatures
Enable verbose HTTP request logging on the web server and parse logs for suspicious characters in the subject parameter
Correlate authentication events and session anomalies with visits to /subject.php containing non-alphanumeric input

Monitoring Recommendations

Alert on any HTTP 200 response from /subject.php where the request contained HTML metacharacters in subject
Monitor browser Content Security Policy violation reports if CSP headers are configured
Track referrer patterns to identify phishing campaigns directing users to crafted timetabling URLs

How to Mitigate CVE-2026-15596

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted networks or place it behind a VPN until a vendor patch is applied
Deploy a WAF ruleset that blocks requests containing script tags or JavaScript event handlers in the subject parameter
Notify users of the timetabling system to avoid clicking unsolicited links referencing /subject.php

Patch Information

No official vendor patch has been referenced in the CVE record at the time of publication. Administrators should monitor the SourceCodester website and the VulDB CVE Entry for updates. In the interim, apply source-level fixes to enforce HTML entity encoding on the subject parameter before rendering.

Workarounds

Modify /subject.php to apply htmlspecialchars($subject, ENT_QUOTES, 'UTF-8') before any output containing user-supplied data
Add a strict Content Security Policy response header that disallows inline scripts and restricts script sources to trusted origins
Set the HttpOnly and Secure flags on session cookies to limit the impact of successful script execution

bash

# Example nginx configuration adding a restrictive Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;