CVE-2026-47325 Weak password policy in ProjectsAndPrograms school-management-system
Attackers can guess student and teacher passwords derived from birth dates to gain unauthorized access to the school management system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47325?
CVE-2026-47325 is a medium-severity vulnerability in ProjectsAndPrograms school-management-system, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.
The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
Weakness: CWE-1391
Which versions are affected by CVE-2026-47325?
How do I fix CVE-2026-47325?
No fix has been published for CVE-2026-47325 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47325 being exploited?
There is no known exploitation of CVE-2026-47325 in the wild and no public exploit code.
Sources
Also known as GHSA-hxqj-5m25-j368.