CVE-2026-47325

ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/06/CVE-2026-47324/
https://oranbyte.com/projects/school-management-system

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El sistema de gestión escolar ProjectsAndPrograms utiliza credenciales predecibles al generar las contraseñas de estudiantes y profesores únicamente a partir de la fecha de nacimiento del usuario (por ejemplo, 12072000 para el 12 de julio de 2000). La aplicación no requiere ni solicita a los usuarios que cambien la contraseña al iniciar sesión por primera vez. Este comportamiento permite a los atacantes adivinar o derivar fácilmente credenciales válidas, lo que lleva a un acceso no autorizado a las cuentas. Los mantenedores fueron notificados con antelación sobre esta vulnerabilidad, pero no proporcionaron detalles sobre las versiones afectadas. La versión correspondiente al commit 6b6fae5 fue probada y confirmada como vulnerable; otras versiones no fueron probadas y también podrían estar afectadas.

03 Jun 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-03 14:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-47325

Mitre link : CVE-2026-47325

CVE.ORG link : CVE-2026-47325

JSON object : View

Products Affected

No product.

CWE

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-47325", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47325", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T15:50:50.868795Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/ProjectsAndPrograms/school-management-system", "vendor": "ProjectsAndPrograms", "product": "school-management-system", "versions": [{"status": "affected", "version": "6b6fae5", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-06-03T14:16:44.823", "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-47324/", "source": "cvd@cert.pl"}, {"url": "https://oranbyte.com/projects/school-management-system", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "ProjectsAndPrograms school-management-system\u00a0uses predictable credentials by generating student's and teacher's passwords solely from the user\u2019s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.\n\nThe maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected."}, {"lang": "es", "value": "El sistema de gesti\u00f3n escolar ProjectsAndPrograms utiliza credenciales predecibles al generar las contrase\u00f1as de estudiantes y profesores \u00fanicamente a partir de la fecha de nacimiento del usuario (por ejemplo, 12072000 para el 12 de julio de 2000). La aplicaci\u00f3n no requiere ni solicita a los usuarios que cambien la contrase\u00f1a al iniciar sesi\u00f3n por primera vez. Este comportamiento permite a los atacantes adivinar o derivar f\u00e1cilmente credenciales v\u00e1lidas, lo que lleva a un acceso no autorizado a las cuentas.\n\nLos mantenedores fueron notificados con antelaci\u00f3n sobre esta vulnerabilidad, pero no proporcionaron detalles sobre las versiones afectadas. La versi\u00f3n correspondiente al commit 6b6fae5 fue probada y confirmada como vulnerable; otras versiones no fueron probadas y tambi\u00e9n podr\u00edan estar afectadas."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "cvd@cert.pl"}