CVE-2026-16155: Class & Exam Timetabling System XSS Flaw

CVE-2026-16155 Overview

CVE-2026-16155 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /schoolyr.php script, where the sy parameter is rendered without proper sanitization or output encoding. Attackers can craft malicious input that executes arbitrary JavaScript in the browser of an authenticated user who interacts with the manipulated request. The exploit is publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The vulnerability is classified under [CWE-79] and requires low privileges plus user interaction, limiting its impact primarily to session-based attacks against legitimate application users.

Critical Impact
Successful exploitation enables session-context script execution, allowing attackers to hijack user sessions, deface content, or redirect users to attacker-controlled destinations.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable file /schoolyr.php (parameter sy)
Any deployment built from the referenced SourceCodester codebase

Discovery Timeline

2026-07-18 - CVE-2026-16155 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16155

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the school-year handling logic of /schoolyr.php. The application accepts the sy request parameter and includes its value in the generated HTML response without applying context-appropriate output encoding. An attacker who can deliver a crafted URL to an authenticated user achieves JavaScript execution in that user's browser session. Because the affected endpoint is reachable over the network, exploitation does not require local access. However, the attacker needs an authenticated context on the target application and must convince a user to trigger the payload. The impact is bounded to integrity effects on the client side, such as content manipulation and session token theft, with no direct server-side confidentiality or availability degradation.

Root Cause

The root cause is missing input validation and output encoding on the sy parameter. User-supplied data flows directly into the HTML response, violating the neutralization requirements outlined in [CWE-79]. No allow-list or HTML-entity encoding routine sanitizes the value before it reaches the rendering layer.

Attack Vector

An attacker crafts a URL that includes a JavaScript payload in the sy query parameter and delivers it through phishing, chat, or a malicious referrer. When an authenticated timetabling-system user opens the link, the payload executes within the application origin. This allows theft of session cookies, forced actions on behalf of the user, or redirection to credential-harvesting infrastructure. The public availability of the proof-of-concept lowers the technical barrier for adversaries.

Refer to the GitHub issue for CVE-2026-16155 and the VulDB CVE-2026-16155 entry for reproduction details.

Detection Methods for CVE-2026-16155

Indicators of Compromise

Web server access logs containing requests to /schoolyr.php with sy values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unexpected outbound requests from user browsers to unknown domains shortly after visits to the timetabling application.
Session anomalies such as concurrent logins from disparate geolocations following interaction with a crafted URL.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the sy parameter on /schoolyr.php for HTML and JavaScript metacharacters.
Enable verbose access logging and alert on query strings containing script tags, event handlers, or base64-encoded payload markers.
Correlate authentication events with referrer headers to identify user-interaction-driven exploitation attempts.

Monitoring Recommendations

Monitor HTTP request patterns targeting schoolyr.php for encoded payloads and repeated probing from single sources.
Instrument client-side Content Security Policy (CSP) violation reporting to capture blocked inline script attempts.
Track session cookie usage for anomalies such as reuse from unexpected IP addresses or user agents.

How to Mitigate CVE-2026-16155

Immediate Actions Required

Restrict access to /schoolyr.php behind authenticated network segments or VPN until a fix is applied.
Deploy WAF signatures that block script-injection patterns in the sy parameter.
Rotate active session tokens and require re-authentication for administrative accounts.

Patch Information

No vendor patch is referenced in the CVE record at the time of publication. SourceCodester users should monitor the SourceCodester project page and the VulDB vulnerability #379920 record for remediation updates. Until an official fix is released, apply the workarounds below.

Workarounds

Implement server-side input validation on the sy parameter using an allow-list of expected school-year formats such as YYYY-YYYY.
Apply context-aware output encoding (HTML entity encoding) before rendering sy in the response.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and SameSite=Strict flags on session cookies to reduce theft impact.

bash

# Example nginx WAF-style rule blocking script payloads in the sy parameter
location /schoolyr.php {
    if ($arg_sy ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
        return 403;
    }
}