Vulnerability · Published Oct 13, 2025 · Assigned by VulDB

CVE-2025-11661ProjectsAndPrograms School Management System missing authentication

High 7.3

In plain English

A high-severity missing authentication in School Management System from ProjectsAndPrograms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery

Affected products (as reported)

Vendor	Product	Versions
ProjectsAndPrograms	School Management System	6b6fae5426044f89c08d0dd101c7fa71f9042a59

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-328078 | ProjectsAndPrograms School Management System missing authentication vdb-entry
VDB-328078 | CTI Indicators (IOB, IOC) signature, permissions-required
Submit #665611 | https://oranbyte.com/ ProjectsAndPrograms/school-management-system 1.0 Widespread Missing Authentication third-party-advisory
https://github.com/qqy-123/cve/issues/6 exploit, issue-tracking