CVE-2026-16486: Class & Exam Timetabling System XSS Flaw

CVE-2026-16486 Overview

CVE-2026-16486 is a reflected cross-site scripting (XSS) vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The flaw resides in the /BSIS.php endpoint, where the day parameter is not properly sanitized before being reflected back to users. An unauthenticated remote attacker can craft a malicious URL that injects arbitrary JavaScript into the victim's browser session. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The vulnerability is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link, enabling session token theft, phishing, and unauthorized actions within the application.

Affected Products

SourceCodester Class and Exam Timetabling System 1.0
/BSIS.php component processing the day parameter
Deployments exposing the application to untrusted network users

Discovery Timeline

2026-07-21 - CVE-2026-16486 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16486

Vulnerability Analysis

The vulnerability exists in the /BSIS.php script of SourceCodester Class and Exam Timetabling System 1.0. The application accepts the day argument from user-controlled input and reflects it into the rendered HTML response without applying output encoding or input sanitization. When a browser renders the response, injected script content executes within the origin of the vulnerable application.

Because the attack vector is network-based and no authentication is required, any user who visits an attacker-supplied URL becomes a target. User interaction is required — the victim must load the malicious link — but no additional privileges or client-side prerequisites are needed. The EPSS probability currently sits at 0.273%, reflecting a public but not yet widely weaponized exploit path.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. The day parameter is echoed into HTML markup without contextual escaping. Standard defenses such as HTML entity encoding, Content Security Policy (CSP) headers, or framework-level output filtering are absent from the vulnerable code path.

Attack Vector

An attacker crafts a URL targeting /BSIS.php with a malicious payload embedded in the day query parameter. The payload is delivered via phishing email, malicious advertising, or a compromised third-party site. When the victim clicks the link, the injected script runs in the context of the vulnerable application, allowing the attacker to read cookies, hijack sessions, submit forged requests, or redirect the user to attacker-controlled infrastructure.

A verified proof-of-concept is not included in the enriched data. Refer to the GitHub Issue for CVE Repository and VulDB CVE-2026-16486 for public technical details.

Detection Methods for CVE-2026-16486

Indicators of Compromise

HTTP requests to /BSIS.php containing URL-encoded HTML tags, <script> fragments, or javascript: schemes in the day parameter.
Web server access logs showing repeated requests to /BSIS.php with abnormally long or entity-encoded day values from a single source.
Browser console errors or CSP violation reports referencing inline script execution originating from the timetabling application.

Detection Strategies

Deploy web application firewall (WAF) rules that flag script tags, event handlers, and encoded payloads in query strings targeting /BSIS.php.
Enable server-side request logging with full query string capture, and alert on payloads matching common XSS signatures such as onerror=, onload=, or <svg.
Correlate suspicious /BSIS.php requests with downstream authentication anomalies such as unexpected session reuse or geographic mismatches.

Monitoring Recommendations

Monitor referrer headers and user-agent patterns for high-volume access to /BSIS.php from external referrers, which may indicate phishing campaigns.
Track outbound HTTP requests from user browsers to unexpected domains following visits to the timetabling system.
Review WAF and reverse proxy telemetry weekly for encoded XSS attempts against form and query parameters.

How to Mitigate CVE-2026-16486

Immediate Actions Required

Restrict public exposure of the SourceCodester Class and Exam Timetabling System 1.0 by placing it behind authenticated VPN or IP allowlisting until a fix is applied.
Apply server-side input validation and HTML entity encoding to the day parameter and any other reflected inputs in /BSIS.php.
Enable a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce exploit impact.

Patch Information

At the time of publication, no official vendor patch has been referenced in the enriched CVE data. Administrators should monitor the SourceCodester Resource Hub and the VulDB Vulnerability #380944 entry for updated remediation guidance. Until a vendor patch is issued, defenders should apply compensating controls such as WAF filtering and virtual patching.

Workarounds

Deploy WAF signatures that strip or block HTML metacharacters (<, >, ", ') in the day query parameter for /BSIS.php.
Add server-side middleware that sanitizes reflected parameters using a vetted library such as OWASP Java Encoder or DOMPurify equivalents for PHP.
Set the HttpOnly and SameSite=Strict attributes on session cookies to limit script-based session theft.
Train users to avoid clicking unsolicited links referencing the timetabling application.

bash

# Example Nginx WAF rule (ModSecurity) to block script payloads in the day parameter
SecRule ARGS:day "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026164860,phase:2,deny,status:403,\
    msg:'Blocked XSS attempt against /BSIS.php day parameter (CVE-2026-16486)'"