School software flaws enable unauthenticated XSS
Two chainable vulnerabilities in ProjectsAndPrograms school-management software let an unauthenticated attacker inject JavaScript and guess predictable passwords.
CERT Polska coordinated disclosure of two vulnerabilities in the open-source ProjectsAndPrograms school-management-system. CVE-2026-47324 is a stored XSS affecting multiple attributes of student and teacher objects, normally requiring an authenticated user such as a teacher or admin to inject malicious script. However, when chained with a previously disclosed vulnerability, CVE-2025-11661, which exposes backend endpoints without authentication, an unauthenticated remote attacker can achieve the same JavaScript injection and execution against other users' browsers.
A second issue, CVE-2026-47325, stems from weak credential generation: student and teacher passwords are derived solely from the user's date of birth (e.g., 12072000) and the system never forces a password change on first login. This makes credentials trivially guessable, allowing attackers to log in as legitimate users without needing to exploit any technical flaw.
The vendor was notified but did not provide information on affected versions; only the commit 6b6fae5 build was confirmed vulnerable during testing, though other versions may share the same code paths. No active exploitation has been reported; this is a coordinated vulnerability disclosure rather than an observed attack campaign.
Mentioned in this report
Detection guidance
Brute Force Attack Against School Management System Login
Detects multiple failed login attempts to ProjectsAndPrograms within a short window, consistent with password-guessing attacks exploiting weak credential generation (CVE-2026-47325). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Brute Force Attack Against School Management System Login
description: Detects multiple failed HTTP POST requests to ProjectsAndPrograms login
endpoint (typically /login, /auth/login) from a single source IP within a short
time window. Weak password generation (date-of-birth derived) makes brute-force
feasible; this rule flags the attack pattern.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: proxy
product: generic
detection:
selection:
DestinationHostname|contains: projectsandprograms
Url|contains:
- /login
- /auth/login
- /authenticate
HttpMethod: POST
HttpStatusCode:
- 401
- 403
condition: selection
falsepositives:
- Users entering incorrect passwords legitimately (e.g., caps lock on, fat-finger)
- Automated testing or security scanning of the application
level: medium
id: 33942a0f-f5ab-59ee-87cf-23d9c129ef9a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-47324
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free