# CVE-2026-90615: SourceCodester Class and Exam Timetabling System XSS in subject parameter

Source: https://junglewise.ai/threats/cve-2026-90615-sourcecodester-class-and-exam-timetabling-system-xss-in-subject  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90615 · Severity: medium · CVSS 4.3 · Published 2026-09-14

SourceCodester's Class and Exam Timetabling System is a web-based application used to manage academic schedules and course information. A cross-site scripting (XSS) vulnerability in the /subject1.php file allows attackers to inject malicious scripts that execute in users' browsers without authentication, potentially enabling theft of session tokens, credential theft, or unauthorized actions performed on behalf of victims.

Technologies: [SourceCodester Class and Exam Timetabling System](https://junglewise.ai/threats/technologies/class-and-exam-timetabling-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-90615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90615 being exploited in the wild.

**How severe is CVE-2026-90615?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** SourceCodester Class and Exam Timetabling System 1.0.

**Is there a fix for CVE-2026-90615?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90615 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90615?** Check whether you run SourceCodester Class and Exam Timetabling System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the /subject1.php file where the 'subject' parameter is output to the web page without proper encoding or input validation. An attacker can craft a malicious URL containing script payload (e.g., <script>prompt(/xss/);</script>) in the subject parameter, which is then executed in the victim's browser when the page is visited. No authentication is required to exploit this vulnerability. The root cause is insufficient output encoding of user-controlled input. Affected versions include v1.0, and the vulnerability is remotely exploitable via network access.

## Affected products

- SourceCodester Class and Exam Timetabling System 1.0

## Timeline

- 2026-09-04: disclosed: Vulnerability disclosed on GitHub
- 2026-09-14: advisory: CVE-2026-90615 published on NVD

## References

- [https://github.com/endingstory/e/issues/2](https://github.com/endingstory/e/issues/2)
- [https://vuldb.com/cve/CVE-2026-90615](https://vuldb.com/cve/CVE-2026-90615)

## Related threats

- [SourceCodester Class and Exam Timetabling System SQL injection in /delete_subject.php](https://junglewise.ai/threats/cve-2026-86298-sourcecodester-class-and-exam-timetabling-system-sql-injection-in)
- [SourceCodester Class and Exam Timetabling System SQL injection in room management](https://junglewise.ai/threats/cve-2026-86225-sourcecodester-class-and-exam-timetabling-system-sql-injection-in)
- [SourceCodester Class and Exam Timetabling System SQL injection in product modal](https://junglewise.ai/threats/cve-2026-86224-sourcecodester-class-and-exam-timetabling-system-sql-injection-in)
- [SourceCodester Class and Exam Timetabling System SQL injection in course parameter](https://junglewise.ai/threats/cve-2026-86223-sourcecodester-class-and-exam-timetabling-system-sql-injection-in)
- [SourceCodester Class and Exam Timetabling System SQL injection in course parameter](https://junglewise.ai/threats/cve-2026-86222-sourcecodester-class-and-exam-timetabling-system-sql-injection-in)