School software flaws enable unauthenticated XSS
Two chainable vulnerabilities in ProjectsAndPrograms school-management software let an unauthenticated attacker inject JavaScript and guess predictable passwords.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in the open-source ProjectsAndPrograms school-management-system. CVE-2026-47324 is a stored XSS affecting multiple attributes of student and teacher objects, normally requiring an authenticated user such as a teacher or admin to inject malicious script. However, when chained with a previously disclosed vulnerability, CVE-2025-11661, which exposes backend endpoints without authentication, an unauthenticated remote attacker can achieve the same JavaScript injection and execution against other users' browsers.
A second issue, CVE-2026-47325, stems from weak credential generation: student and teacher passwords are derived solely from the user's date of birth (e.g., 12072000) and the system never forces a password change on first login. This makes credentials trivially guessable, allowing attackers to log in as legitimate users without needing to exploit any technical flaw.
The vendor was notified but did not provide information on affected versions; only the commit 6b6fae5 build was confirmed vulnerable during testing, though other versions may share the same code paths. No active exploitation has been reported; this is a coordinated vulnerability disclosure rather than an observed attack campaign.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-47324
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs