A vulnerability in SourceCodester’s Barangay Resident Profiling and Information Management System allows an attacker to manipulate the password reset functionality so that the field new_password accepts the hard‑coded value "password123". Setting this value causes the system to store a known password on the target account, effectively bypassing credential protection and granting unauthorized access. This flaw corresponds to CWE‑255 (Sensitive Data Exposure) and CWE‑259 (Hard‑coded Credentials).

The affected product is SourceCodester’s Barangay Resident Profiling and Information Management System, version 1.0.

The CVSS score of 6.9 classifies the vulnerability as moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation may be launched remotely by sending a crafted request to the passsword_reset.php endpoint. The CVE description does not state whether authentication is required to use the password reset, but it is likely (inferred from typical password reset mechanisms) that the endpoint can be accessed without credentials. If authentication is indeed required, the attacker would need valid credentials or a way to obtain them before the reset can be performed; if no authentication is required, the attack becomes straightforward. The public disclosure of the exploit means that the method is known and could be applied readily by adversaries who can reach the endpoint.