CVE Explorer
CVE-2026-47325
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.
The maintainers were notified early about this vulnerability but did not provide details regarding
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unknown","product":"school-management-system","repo":"https://github.com/ProjectsAndPrograms/school-management-system","vendor":"ProjectsAndPrograms","versions":[{"status":"affected","version":"6b6fae5","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:6c0c52a2c06f720c53eec929e77d033c1a143db6c0511fb0b4bbce4cda99bc89 · sha256:9bb9d3f0be68bcf2… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LO…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:6c0c52a2c06f720c53eec929e77d033c1a143db6c0511fb0b4bbce4cda99bc89 · sha256:9bb9d3f0be68bcf2… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-1391","description":"CWE-1391 Use of Weak Credentials","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:6c0c52a2c06f720c53eec929e77d033c1a143db6c0511fb0b4bbce4cda99bc89 · sha256:9bb9d3f0be68bcf2… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"tags":["third-party-advisory"],"url":"https://cert.pl/en/posts/2026/06/CVE-2026-47324/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6c0c52a2c06f720c53eec929e77d033c1a143db6c0511fb0b4bbce4cda99bc89 · sha256:9bb9d3f0be68bcf2… · /containers/cna/references/0
{"tags":["product"],"url":"https://oranbyte.com/projects/school-management-system"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6c0c52a2c06f720c53eec929e77d033c1a143db6c0511fb0b4bbce4cda99bc89 · sha256:9bb9d3f0be68bcf2… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.