CVE-2025-48372

CVE-2025-48372 is a brute-force vulnerability affecting the generateOTP() function in the open-source Schule school management system prior to version 1.0.1. The 4-digit numeric OTP, with only 9000 possible combinations, is highly susceptible to brute-force attacks due to its small keyspace and lack of strong rate-limiting. This vulnerability carries a CVSS score of 7.3 (HIGH), indicating it can be exploited over the network with low attack complexity, potentially leading to partial confidentiality, integrity, and availability impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.