CVE-2026-15715: Class and Exam Timetabling System XSS

CVE-2026-15715 Overview

CVE-2026-15715 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /exam.php script, where the day request parameter is echoed into the response without proper output encoding. An unauthenticated remote attacker can craft a malicious URL that, when opened by a victim, executes attacker-controlled JavaScript in the victim's browser session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). A public exploit is referenced in the disclosure, and user interaction is required for successful exploitation.

Critical Impact
Attackers can execute arbitrary script in a victim browser to hijack sessions, steal credentials, or perform actions on behalf of authenticated timetabling users.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable component is the /exam.php endpoint
The vulnerable parameter is the day GET argument

Discovery Timeline

2026-07-14 - CVE-2026-15715 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15715

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the /exam.php script of the Class and Exam Timetabling System. The application accepts a day query parameter and returns it in the HTML response without contextual escaping. An attacker who can convince a user to click a crafted link injects arbitrary JavaScript that executes in the target's browser under the origin of the vulnerable application.

Exploitation is remote and requires no authentication, but does require user interaction to load the malicious URL. Successful exploitation can result in session cookie theft, credential harvesting through injected forms, defacement of rendered pages, or forced actions using the victim's authenticated session against the timetabling application.

Root Cause

The root cause is missing input sanitization and output encoding on the day parameter in /exam.php. User-supplied data is inserted directly into the HTML output stream, allowing markup and script tags to break out of the surrounding context. No Content Security Policy or framework-level auto-escaping is present to compensate for the missing server-side encoding.

Attack Vector

The attack vector is network-based over HTTP. An attacker constructs a URL of the form http://<target>/exam.php?day=<payload> where the payload contains JavaScript such as a <script> block or an event handler on an injected element. The victim must open the link, typically delivered through phishing, chat, or a compromised referring site. When the browser renders the response, the injected script executes with access to cookies, the DOM, and any authenticated session state for the application.

See the GitHub issue discussion and VulDB CVE details for the public proof-of-concept description.

Detection Methods for CVE-2026-15715

Indicators of Compromise

HTTP GET requests to /exam.php containing script tags, event handlers, or URL-encoded payloads in the day parameter
Web server access logs showing values such as day=%3Cscript%3E, day=<img onerror, or javascript: schemes
Referrer headers on outbound requests pointing to unexpected external domains after a user visits /exam.php
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after loading exam pages

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the day parameter for HTML metacharacters and known XSS patterns
Enable verbose access logging on the web server and alert on non-alphanumeric characters in the day query string
Perform authenticated dynamic application security testing (DAST) against /exam.php with XSS payload libraries
Correlate browser console errors and CSP violation reports, if a policy is later deployed, against the timetabling origin

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized log platform and build queries for XSS keywords targeting exam.php
Monitor authentication events for session anomalies such as concurrent logins from geographically distant IPs following exam page access
Track browser telemetry, if available, for script execution originating from reflected URL parameters

How to Mitigate CVE-2026-15715

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted networks or authenticated users until a fix is applied
Deploy WAF rules that block or sanitize the day parameter on requests to /exam.php
Warn users of the application to avoid clicking untrusted links referencing the timetabling host
Rotate session secrets and force re-authentication if suspicious day payloads appear in logs

Patch Information

At the time of publication, no vendor patch has been referenced in the NVD entry for CVE-2026-15715. Administrators should monitor the SourceCodester website and the VulDB advisory for updated releases and apply fixes as soon as they become available.

Workarounds

Apply a server-side filter that HTML-encodes the day parameter before it is echoed into the response, using functions such as htmlspecialchars($_GET['day'], ENT_QUOTES, 'UTF-8')
Add a strict Content Security Policy header that disallows inline scripts and restricts script sources to the application's own origin
Set the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution
Remove or rename /exam.php in deployments where the endpoint is not required

bash

# Example Apache mod_security rule to block script payloads in the day parameter
SecRule ARGS:day "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026015715,phase:2,deny,status:403,log,\
     msg:'CVE-2026-15715 XSS attempt against /exam.php day parameter'"