CVE-2025-48375 Schule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoS
Attackers can flood OTP emails due to missing rate limiting, causing denial of service or harassment in the Schule school management system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48375?
CVE-2025-48375 is a medium-severity denial of service vulnerability in schule111 Schule, published on 23 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2025-48375?
It affects 1 product.
Products include Schule111 Schule School Management System.
How do I fix CVE-2025-48375?
No fix has been published for CVE-2025-48375 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-48375 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48375 exists.