# School management system hit by XSS, credential flaws

Published: 2026-06-03 · Severity: high · Sectors: education
Canonical: https://vorant.io/reports/675d4729-9e49-40b0-a44d-b29968af86d0/school-management-system-hit-by-xss-credential-flaws

> ProjectsAndPrograms school-management-system contains stored XSS and predictable password vulnerabilities that enable unauthorized access and code execution.

CERT Polska disclosed two vulnerabilities in ProjectsAndPrograms school-management-system software used in educational institutions. CVE-2026-47324 is a stored cross-site scripting vulnerability affecting multiple attributes of student and teacher objects, allowing authorized users to inject malicious JavaScript executed in other users' browsers. When combined with CVE-2025-11661, which permits unauthenticated backend access, remote attackers can exploit this XSS without any privileges.

CVE-2026-47325 involves predictable credential generation, where the system creates passwords solely from users' dates of birth in a simple numeric format. The application does not enforce password changes on first login, enabling attackers to easily guess valid credentials and gain unauthorized account access. The maintainers were notified but did not specify which versions are affected beyond the tested commit 6b6fae5.

These vulnerabilities pose significant risk to educational institutions using this software, as they enable both session hijacking through XSS and direct account compromise through credential guessing. The credential weakness is particularly concerning given the sensitive student and staff data typically managed by school administration systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11661, CVE-2026-47324, CVE-2026-47325

## Detection guidance (public sample)

### Possible Stored XSS Payload Submitted via Student/Teacher Object Fields

ATT&CK: T1059.007

Detects HTTP POST/PUT requests to profile or object-update endpoints containing script injection markers (e.g. <script>, onerror=, javascript:) in the request body/query, consistent with exploitation of stored XSS in school-management-system attributes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Stored XSS Payload in Web Application Request
id: d15d6e76-97f4-5b1a-b7d1-f188455f8875
status: experimental
description: Detects web requests containing script-injection markers in the request
  URI/body, indicative of stored XSS exploitation such as CVE-2026-47324 affecting
  student/teacher object fields.
references:
- CERT Polska advisory on ProjectsAndPrograms XSS/credential flaws
logsource:
  category: webserver
detection:
  selection:
    cs-method:
    - POST
    - PUT
    cs-uri-query|contains:
    - <script
    - onerror=
    - onload=
    - 'javascript:'
    - document.cookie
  filter:
    cs-uri-stem|contains:
    - /static/
    - /assets/
  condition: selection and not filter
falsepositives:
- Legitimate rich-text content or HTML snippets submitted by trusted CMS/admin users
- Security scanners or QA test suites intentionally sending XSS test payloads
level: medium
tags:
- attack.T1059.007
- attack.execution
author: Vorant
```

### Login Attempt Using Numeric Date-of-Birth-Formatted Password

ATT&CK: T1110.001

Detects authentication attempts where the submitted password parameter consists solely of digits in a date-like length (6-8 characters), matching the predictable DOB-based password generation scheme of CVE-2026-47325; repeated occurrences across many accounts in a short window indicate password-guessing activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Authentication Attempt With Date-of-Birth Style Numeric Password
id: 58defe4d-d7bf-5683-a808-3bfb1eabb0b9
status: experimental
description: Detects login requests where the password field is purely numeric and
  6-8 characters long, matching predictable DOB-derived default credentials. A high
  volume of such attempts across distinct usernames from one source over a short period
  should be investigated as password guessing.
references:
- CERT Polska advisory on ProjectsAndPrograms XSS/credential flaws
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - /login
    - /auth
    cs-method: POST
    cs-uri-query|re: (?i)password=[0-9]{6,8}(&|$)
  condition: selection
falsepositives:
- Legitimate users whose organisation-issued passwords happen to be numeric and were
  not yet changed
- Load-testing or QA automation scripts using numeric test credentials
level: medium
tags:
- attack.T1110.001
- attack.credential_access
author: Vorant
```

### Successful Login Immediately Following Multiple Failed Attempts Against Distinct Accounts

ATT&CK: T1078

Detects a successful authentication response (HTTP 200/302 on the login endpoint) from a source that had prior failed login responses on the same endpoint, consistent with valid-account compromise after guessing predictable DOB-based passwords. Note: the sustained pattern (many failures across many usernames from one source before a success) should be validated over a time window by the SIEM correlation layer. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Successful Login Following Prior Failed Attempts on Same Endpoint
id: 51027014-7957-5895-8503-efaafa1f4be7
status: experimental
description: Detects a successful login response on an authentication endpoint that
  may follow a series of failed login attempts, suggesting valid account access gained
  via credential guessing (e.g. predictable DOB-based passwords). Correlate with prior
  failed attempts from the same source over a short window for higher confidence.
references:
- CERT Polska advisory on ProjectsAndPrograms XSS/credential flaws
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - /login
    - /auth
    cs-method: POST
    sc-status:
    - 200
    - 302
  condition: selection
falsepositives:
- Normal successful logins by legitimate users after a mistyped password
- Single sign-on or password-reset flows that redirect through the login endpoint
level: low
tags:
- attack.T1078
- attack.initial_access
- attack.persistence
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-47324

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/675d4729-9e49-40b0-a44d-b29968af86d0/school-management-system-hit-by-xss-credential-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup