{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-47325 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-47325 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-47325 is a medium-severity vulnerability in ProjectsAndPrograms school-management-system, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-47325 and fix it if it is affected.\n\nWhat it is: CVE-2026-47325 is a medium-severity vulnerability in ProjectsAndPrograms school-management-system, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-47325 in the wild and no public exploit code.\n\nAffected product: ProjectsAndPrograms school-management-system. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-47325/ (Markdown: https://insights.sbomify.com/CVE-2026-47325/index.md)","id":"CVE-2026-47325","markdown":"https://insights.sbomify.com/CVE-2026-47325/index.md","name":"CVE-2026-47325","record":{"aliases":["GHSA-hxqj-5m25-j368"],"analysis":{"component_type":"web_application","fix_type":"no_fix_stated","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"School management system","requires_auth":"none","summary":"Attackers can guess student and teacher passwords derived from birth dates to gain unauthorized access to the school management system.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CERT-PL","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-1391","name":"Use of Weak Credentials"}],"description":"ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.\n\nThe maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Weak password policy in ProjectsAndPrograms school-management-system","id":"CVE-2026-47325","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"weak_cryptography","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Memory leak in Ubuntu Linux AppArmor large notification response allocation","id":"CVE-2026-47326"},"packages":[],"prev":{"headline":"Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system","id":"CVE-2026-47324"},"products":["school-management-system"],"published":"2026-06-03","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-06-03","vendors":["ProjectsAndPrograms"]},"summary":"Attackers can guess student and teacher passwords derived from birth dates to gain unauthorized access to the school management system.","url":"https://insights.sbomify.com/CVE-2026-47325/"}