Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.6

Schule School Management System Allows Abusive Password Reset Emails

CVE-2025-48375 · published 1 year ago
Summary

If not updated to 1.0.1 or later, the Schule school management system can be exploited by attackers to send many password reset emails in a short time, potentially overwhelming the system or flooding users' inboxes. This could lead to disruption or annoyance for users and administrators. Update to 1.0.1 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
schule111 schule_school_management_system 1.0.0
cpe:2.3:a:schule111:schule_school_management_system:1.0.0:*:*:*:*:*:*:*
Original advisory text
Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate l...
Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published23 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-48375 · NVD
Track software like this
Free during beta