CVE-2026-16485: Class and Exam Timetabling XSS Flaw

CVE-2026-16485 Overview

CVE-2026-16485 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /class.php script, where the day parameter is rendered back to the browser without proper output encoding. An unauthenticated attacker can craft a malicious URL and, with minimal user interaction, execute arbitrary JavaScript in the victim's browser session. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations. This issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can inject arbitrary scripts through the day parameter of /class.php, enabling session theft, credential capture, and drive-by actions performed as the victim.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
The vulnerable component is the /class.php endpoint
The day GET/POST parameter is the injection sink

Discovery Timeline

2026-07-21 - CVE-2026-16485 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16485

Vulnerability Analysis

The vulnerability is a classic reflected cross-site scripting flaw in the /class.php script of the Class and Exam Timetabling System. User-supplied input in the day parameter is echoed back into the HTTP response without HTML entity encoding or context-aware sanitization. When a victim loads a crafted URL, the injected payload executes inside the origin of the vulnerable application.

Because the attack is delivered over the network and requires only that a target visit a malicious link, exploitation is straightforward. Publicly available proof-of-concept material referenced by the VulDB entry and the GitHub issue discussion further lowers the barrier for attackers.

Root Cause

The root cause is missing output encoding on the day parameter before it is written into the HTML response. The application trusts client-supplied data and concatenates it into the page markup, violating the guidance in CWE-79. A defense-in-depth failure — no Content Security Policy and no input allowlist — permits arbitrary script content to reach the DOM.

Attack Vector

An attacker crafts a link such as /class.php?day=<script>...</script> and delivers it via phishing email, chat, or a third-party page. When an authenticated user or administrator clicks the link, the injected JavaScript runs in their browser context. Typical post-exploitation actions include stealing session cookies, performing forced administrative operations through CSRF-like flows, and rewriting page content to harvest credentials.

No verified exploit code is published beyond the referenced advisories. See the VulDB vulnerability details for additional technical context.

Detection Methods for CVE-2026-16485

Indicators of Compromise

Web server access logs containing requests to /class.php with day parameter values that include <, >, script, onerror, or URL-encoded equivalents (%3Cscript).
Outbound HTTP requests from user browsers to attacker-controlled domains immediately after visiting /class.php.
Unexpected session activity or administrative changes originating from user accounts that recently loaded crafted class.php URLs.

Detection Strategies

Deploy a web application firewall rule that inspects the day parameter of /class.php for HTML tags, event handlers, and JavaScript URI schemes.
Enable verbose HTTP request logging and hunt for the pattern class.php?day= followed by non-alphanumeric characters.
Correlate suspicious class.php requests with subsequent authentication events or configuration changes in the application.

Monitoring Recommendations

Alert on any HTTP 200 response from /class.php whose reflected content contains <script, onerror=, or javascript:.
Monitor browser-side security telemetry for Content Security Policy violation reports on pages served by the timetabling system.
Track user reports of unexpected redirects, pop-ups, or session terminations tied to timetabling URLs.

How to Mitigate CVE-2026-16485

Immediate Actions Required

Restrict access to the Class and Exam Timetabling System to trusted networks or authenticated internal users until a patched build is deployed.
Add a WAF rule that blocks or sanitizes requests to /class.php when the day parameter contains HTML metacharacters.
Notify users and administrators to avoid clicking untrusted links that reference the timetabling application.

Patch Information

No official vendor patch is referenced in the advisory data. Administrators should monitor the SourceCodester project page and the VulDB entry for CVE-2026-16485 for updated builds. Until a fix is published, apply source-level remediation by HTML-encoding the day parameter before rendering it, using functions such as htmlspecialchars($_GET['day'], ENT_QUOTES, 'UTF-8') in PHP.

Workarounds

Implement server-side input validation that restricts day to a known set of values, such as day names or integers.
Serve the application with a strict Content Security Policy that disallows inline scripts and untrusted script sources.
Set the HttpOnly and Secure flags on session cookies to limit the impact of stolen tokens.
Enable the SameSite=Lax or SameSite=Strict cookie attribute to reduce cross-origin exploitation vectors.

bash

# Example nginx WAF-style rule to block obvious XSS payloads on the day parameter
location /class.php {
    if ($arg_day ~* "(<|>|script|onerror|javascript:|%3C)") {
        return 403;
    }
    # existing PHP handler configuration
}