This vulnerability (CVE-2025-7708) in the k12net software by Atlas Educational Software Industry Ltd. involves the insertion of sensitive information into data sent over communication channels, which can lead to manipulation of those channels. The vulnerability affects versions of k12net up to and including 09022026. The vendor did not provide any response or patch information. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, low privileges, and user interaction, with high confidentiality impact, low integrity impact, and low availability impact.

An attacker with network access and low privileges who can trick a user into interaction may insert sensitive information into transmitted data, potentially compromising confidentiality. The integrity and availability impacts are low. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor did not respond to the disclosure and no patch links are available, users should monitor official channels for updates. No specific mitigations are provided by the vendor at this time.