Vulnerability · Published May 23, 2025 · Assigned by GitHub_M

CVE-2025-48375Schule Missing Rate Limiting on OTP Email Requests – Susceptible to Abuse & DoS

Medium 6.6

In plain English

A medium-severity resource allocation without limits in Schule from schule111. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)6.6Medium

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
schule111	Schule	< 1.0.1

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/schule111/Schule/security/advisories/GHSA-h3f2-mc85-67gc x_refsource_CONFIRM