# CVE-2026-47325: ProjectsAndPrograms school-management-system use of predictable credentials

Source: https://junglewise.ai/threats/cve-2026-47325-projectsandprograms-school-management-system-use-of-predictable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-47325 · Severity: info · CVSS 6.9 · Published 2026-06-03

The ProjectsAndPrograms school management system, used for managing student and teacher records, uses a predictable password generation method based on a user's date of birth. Because the system does not force users to change these passwords, an attacker can easily guess login credentials to gain unauthorized access to school accounts. This could lead to the exposure of sensitive student and staff information or unauthorized changes to school records.

## Quick answers

**Is CVE-2026-47325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47325 being exploited in the wild.

**How severe is CVE-2026-47325?** Informational severity, with a CVSS score of 6.9, published 3 June 2026.

**Which products and versions are affected?** ProjectsAndPrograms school-management-system commit 6b6fae5 and potentially others.

**Is there a fix for CVE-2026-47325?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47325 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47325?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The school-management-system application suffers from a weak credential vulnerability (CWE-1391) where student and teacher passwords are automatically generated using only the user's date of birth (DDMMYYYY format). The application lacks a mechanism to force or prompt a password change upon the first login, leaving accounts vulnerable indefinitely. A remote, unauthenticated attacker can derive valid credentials if they possess or can guess a user's birth date. This vulnerability was confirmed in the version corresponding to commit 6b6fae5. While the maintainers were notified, no official patch or version information has been provided.

## Affected products

- ProjectsAndPrograms school-management-system commit 6b6fae5 and potentially others

## Timeline

- 2026-06-03: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-03: advisory: CVE-2026-47325 published

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-47324/](https://cert.pl/en/posts/2026/06/CVE-2026-47324/)
- [https://oranbyte.com/projects/school-management-system](https://oranbyte.com/projects/school-management-system)