ProjectsAndPrograms School Management System Stored XSS (CVE-2026-47324) and Weak Credentials (CVE-2026-47325) Advisory

Vulnerability Overview CERT Polska reported two vulnerabilities in the ProjectsAndPrograms school management system software: 1. CVE-2026-47324: Stored Cross-Site Scripting (XSS) vulnerability. 2. CVE-2026-47325: Weak credentials vulnerability. Affected Scope CVE-2026-47324: - Vulnerability Type: Stored Cross-Site Scripting (XSS). - Impact: Attackers (such as teachers or administrators) can inject malicious JavaScript code into various attributes of student and teacher objects, which will then execute in other users' browsers. - Severity: When combined with CVE-2025-11661, attackers can inject and execute arbitrary JavaScript code without authorization. CVE-2026-47325: - Vulnerability Type: Weak credentials. - Impact: May lead to unauthorized access. Remediation CVE-2026-47324: - Remediation Advice: Properly neutralize input to prevent cross-site scripting attacks. CVE-2026-47325: - Remediation Advice: Use strong credentials and avoid weak passwords. Detailed Information CVE IDs: - CVE-2026-47324 - CVE-2026-47325 Disclosure Date: June 3, 2026 Vendor: ProjectsAndPrograms Product: school-management-system Affected Version: 6b6fae5 Vulnerability Types (CWE): - CVE-2026-47324: CWE-79 (Cross-site Scripting) - CVE-2026-47325: CWE-1391 (Weak Credentials) Reporting Source: CERT Polska Description CERT Polska received reports regarding vulnerabilities in the ProjectsAndPrograms school management system software and participated in the coordination of disclosure. CVE-2026-47324: The ProjectsAndPrograms school management system contains a stored Cross-Site Scripting (XSS) vulnerability. Attackers can inject malicious JavaScript code into various attributes of student and teacher objects, which will execute in other users' browsers. When combined with CVE-2025-11661, attackers can inject and execute arbitrary JavaScript code without authorization. CVE-2026-47325: A weak credentials vulnerability exists, which may lead to unauthorized access. Proof of Concept (POC) Code or Exploit Code No specific POC code or exploit code was provided.

Goal Reached Thanks to every supporter — we hit 100%!

ProjectsAndPrograms School Management System Stored XSS (CVE-2026-47324) and Weak Credentials (CVE-2026-47325) Advisory