CVE-2026-16156: Class Timetabling System XSS Vulnerability

CVE-2026-16156 Overview

CVE-2026-16156 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /forexam.php script, where the day parameter is rendered back to the browser without proper sanitization or encoding. An authenticated remote attacker can inject arbitrary JavaScript that executes in the victim's browser session after user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The vulnerability is tracked under CWE-79.

Critical Impact
Successful exploitation allows attackers to execute JavaScript in a victim's browser context, enabling session token theft, phishing overlays, and unauthorized actions within the timetabling application.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
Deployments serving the vulnerable /forexam.php endpoint
Any downstream forks reusing the same request handling logic

Discovery Timeline

2026-07-18 - CVE-2026-16156 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16156

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the /forexam.php component of the Class and Exam Timetabling System. The day HTTP parameter accepted by this endpoint is written back into the HTML response without contextual output encoding. As a result, attacker-supplied markup and script fragments are interpreted by the browser as active content. Exploitation requires a low-privileged authenticated session and user interaction such as clicking a crafted link. Once triggered, the injected payload executes with the privileges of the current user inside the application's origin. Public disclosure of the technique on GitHub and VulDB lowers the barrier for reuse by opportunistic attackers.

Root Cause

The root cause is missing input validation and output encoding on the day request parameter in /forexam.php. The application concatenates untrusted input directly into HTML output, violating the principles described in CWE-79. No Content Security Policy (CSP) is enforced to mitigate reflected script execution.

Attack Vector

An attacker crafts a URL targeting /forexam.php with a malicious day value containing script content. The attacker delivers the link through phishing, chat, or a compromised page. When an authenticated user opens the link, the server reflects the payload and the browser executes it in the application's context. The attacker can then exfiltrate session cookies, submit forged requests, or manipulate rendered content. See the GitHub CVE Issue Discussion and the VulDB Vulnerability Details for a technical breakdown.

Detection Methods for CVE-2026-16156

Indicators of Compromise

HTTP requests to /forexam.php containing day= values with <script>, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E.
Outbound requests from user browsers to unexpected domains shortly after visiting the timetabling application.
Web server access logs showing unusually long or encoded day parameter values from external referrers.

Detection Strategies

Deploy a web application firewall rule to flag reflected script patterns in query strings targeting /forexam.php.
Correlate authenticated user sessions with requests carrying suspicious day parameter values in SIEM searches.
Perform authenticated dynamic application security testing (DAST) against the endpoint with XSS payload lists.

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized log platform for query-string inspection.
Alert on repeated 200 responses to /forexam.php that contain reflected <script> fragments in the response body.
Track referer patterns to identify phishing sources delivering crafted links to internal users.

How to Mitigate CVE-2026-16156

Immediate Actions Required

Restrict external access to the Class and Exam Timetabling System until a fix is deployed, using network ACLs or VPN gating.
Apply server-side input validation on the day parameter, permitting only expected date formats or whitelisted values.
Enforce HTML output encoding on all user-controlled values rendered by /forexam.php.
Invalidate active sessions and rotate authentication cookies after remediation.

Patch Information

No official vendor patch has been published for SourceCodester Class and Exam Timetabling System 1.0 at the time of the NVD entry. Administrators should monitor the SourceCodester Resource Hub and the VulDB CVE Report for updates, and consider maintaining a local fork with the mitigations described below.

Workarounds

Add a strict Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self' to limit inline script execution.
Filter the day parameter at a reverse proxy using a regex that only allows digits or a defined date pattern.
Set the HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of stolen tokens.
Provide targeted user awareness reminders about clicking unsolicited links to the application.

bash

# Configuration example: nginx reverse proxy filter for the day parameter
location = /forexam.php {
    if ($arg_day !~* "^[0-9]{1,2}$") {
        return 400;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    add_header X-XSS-Protection "1; mode=block" always;
    proxy_pass http://backend;
}