CVE-2026-47325

Vulnerability

The ProjectsAndPrograms school-management-system application generates user passwords solely from the user's date of birth, such as 12072000 for July 12, 2000. The application does not enforce a password change upon first login. The version corresponding to commit 6b6fae5 was confirmed vulnerable; other versions may also be affected [1].

Exploitation

An attacker can exploit this vulnerability by guessing or deriving valid user credentials based on their date of birth. No specific network position, authentication, or user interaction is required beyond obtaining or guessing a user's date of birth.

Impact

Successful exploitation allows an attacker to gain unauthorized access to user accounts, potentially leading to the disclosure of sensitive information or further compromise of the system, depending on the privileges of the accessed account.

Mitigation

No patched version or specific mitigation details have been disclosed in the available references. The maintainers were notified of this vulnerability but have not yet provided a fix. The affected version is 6b6fae5 [1].