The vulnerability occurs in the ajax_forgot_password function of the Login controller; manipulating the email parameter results in a weak password recovery process. The flaw is classified as CWE-640, an insecure password recovery mechanism. The likely attack vector is remote via the forgot‑password endpoint, as the description explicitly states the attack can be launched remotely and the exploitation appears to be difficult.

The affected product is the OUSL‑GROUP‑BrinaryBrains School Student Management System. No specific version numbers are available because the product does not use versioning; however, any instance running the vulnerable commit up to the hash 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 is susceptible.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack is characterized by high complexity and is reported as difficult to exploit, but the exploit is public, so systems exposing the forgot‑password endpoint to unauthenticated users face a moderate risk of compromise.