CVE-2026-15715 MEDIUM

CVE-2026-15715: SourceCodester Class and Exam Timetabling System exam.php cross site scripting

Vendor Sourcecodester

Product Class and Exam Timetabling System

Weakness CWE-79 · XSS

Published July 14, 2026

Last update July 14, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /exam.php. Such manipulation of the argument day leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Key dates

02Disclosure timeline

July 14, 2026 CVE published

July 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-15715 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-66429 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerability CVE-2026-66471 WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 CVE-2026-16145 Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter CVE-2026-73358 WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability