CVE-2026-47325 describes a vulnerability in the ProjectsAndPrograms school-management-system where user passwords for students and teachers are generated solely from their date of birth in a predictable format (e.g., DDMMYYYY). The system does not enforce or prompt for password changes upon initial login, enabling attackers to easily guess or derive valid credentials. The vulnerability was confirmed in version 6b6fae5; other versions have not been tested but may also be vulnerable. There is no available patch or official remediation guidance from the vendor.

Attackers can gain unauthorized access to user accounts by guessing passwords derived from easily obtainable personal information (dates of birth). This compromises account confidentiality and potentially allows further unauthorized actions within the system. The vulnerability does not require user interaction or privileges to exploit and has a medium severity rating (CVSS 6.9). No known exploits are reported in the wild.

No official patch or remediation has been provided by the vendor. Users and administrators should consider implementing additional security controls such as enforcing password changes on first login, disallowing weak or predictable passwords, and applying multi-factor authentication if possible. Monitoring for unauthorized access attempts is advisable until an official fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.