Predictable passwords are generated from a user’s date of birth, such as 12072000 for 12 July 2000, and the system takes no action to prompt or require a change on first login. The weakness, classified as CWE‑1391, allows an attacker to guess or calculate valid credentials with minimal effort, resulting in unauthorized account access.

The vulnerable product is ProjectsAndPrograms:school‑management‑system. The commit 6b6fae5 has been confirmed vulnerable; other releases have not been verified but may also be affected.

The CVSS score of 6.9 indicates a medium severity vulnerability. No EPSS data is available and it is not listed in the CISA KEV catalog. Attackers could exploit the flaw by guessing or deriving the password for any account if they know the user’s date of birth; once authenticated, an attacker gains full access to that account’s privileges.