What is CVE-2025-48375?

CVE-2025-48375 is a medium-severity vulnerability in Schule111 Schule, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2025-05-23.

How severe is CVE-2025-48375?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2025-48375 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Schule111 Schule

CVE-2025-48375

Schule is open-source school management system software. Prior to version 1.0.1, the file forgot_password.php (or equivalent endpoint responsible for email-based OTP generation) lacks proper rate limiting controls, allowing attackers to abuse the OTP request functionality. This vulnerability can be exploited to send an excessive number of OTP emails, leading to potential denial-of-service (DoS) conditions or facilitating user harassment through email flooding. Version 1.0.1 fixes the issue.

EPSS: 0.004 (28.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Schule111 Schule — versions < 1.0.1
Schule111 Schule_school_management_system — versions 1.0.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-48375?: CVE-2025-48375 is a medium-severity vulnerability in Schule111 Schule, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2025-05-23.
How severe is CVE-2025-48375?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2025-48375 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.