CVE-2025-48375mediumCWE-770

CVE-2025-48375: fallo de gravedad media en schule111 Schule

Schule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoS

Publicada el

Seguir esta CVE+ Monitorear Schule

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.6epss 0.4%
Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Productos afectados
schule111 · Schule
CVEs relacionadas — schule111 Schule

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-48373MEDIUMSchule Has Client-Side Role-Based Access Control (RBAC) Bypass VulnerabilityEPSS 0.4%CVE-2025-48372MEDIUMSchule Has Insecure OTP Length, is Susceptible to Brute-Force AttacksEPSS 0.3%