CVE-2026-47325
CVE-2026-47325 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1391.
Key facts
- Severity: Medium (CVSS 4.0 base score 6.9)
- EPSS exploit prediction: 0% (16th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-34094
- Weakness: CWE-1391
- Published:
- Last modified:
Description
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
Frequently asked questions
- What is CVE-2026-47325?
- ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.
- How severe is CVE-2026-47325?
- CVE-2026-47325 has a CVSS 4.0 base score of 6.9, rated medium severity.
- Is CVE-2026-47325 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-47325?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-47325 have an EU (EUVD) identifier?
- Yes. CVE-2026-47325 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34094.
- When was CVE-2026-47325 published?
- CVE-2026-47325 was published on 2026-06-03 and last updated on 2026-06-17.
References
- https://cert.pl/en/posts/2026/06/CVE-2026-47324/
- https://oranbyte.com/projects/school-management-system
Other CWE-1391 vulnerabilities
- CVE-2025-67114 — Critical (CVSS 9.8): Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi…
- CVE-2026-22886 — Critical (CVSS 9.8): OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the…
- CVE-2025-30519 — Critical (CVSS 9.8): Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through…
- CVE-2025-6077 — Critical (CVSS 9.8): Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and…
- CVE-2024-51978 — Critical (CVSS 9.8): An unauthenticated attacker who knows the target device's serial number, can generate the default administrator…
- CVE-2024-12728 — Critical (CVSS 9.8): A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than…