CVE-2025-48375 Details
Description
Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.
A denial-of-service vulnerability has been identified in the open-source school management system, Schule, prior to version 1.0.1. The issue arises in the forgot_password.php file, or equivalent endpoints responsible for generating email-based one-time passwords (OTPs). These endpoints lack adequate rate limiting, enabling attackers to exploit the OTP request feature. This exploitation can result in the sending of a large volume of OTP emails, causing potential denial-of-service conditions or facilitating harassment of users through email flooding.
Users can upgrade to Schule version 1.0.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/schule111/Schule/security/advisories/GHSA-h3f2-mc85-67gc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| schule111 schule school management system | 1.0.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2025 | Initial Analysis | [email protected] |
| May 23, 2025 | New CVE Received | [email protected] |