Cyber Posture

CVE-2025-11661

HighPublic PoC

Published: 13 October 2025

Published
13 October 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0019 40.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11661 is a high-severity Improper Authentication (CWE-287) vulnerability in Oranbyte School Management System. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 3 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-287 CWE-306

Session content review can reveal authentication bypasses or failures in session establishment.

addresses: CWE-287 CWE-306

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

addresses: CWE-287 CWE-306

Documented IA policy and procedures require proper authentication mechanisms to be defined and followed, reducing improper authentication.

addresses: CWE-287 CWE-306

Requires adaptive authentication under specific conditions, directly strengthening authentication mechanisms against improper or insufficient authentication.

addresses: CWE-287 CWE-306

Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.

addresses: CWE-287 CWE-306

Requires unique identification and authentication of organizational users, directly preventing improper authentication.

addresses: CWE-287 CWE-306

Enforces unique device identification and authentication before any connection is established, directly mitigating improper authentication weaknesses.

addresses: CWE-287 CWE-306

Directly requires implementation of compliant authentication mechanisms to cryptographic modules, preventing improper authentication.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.004 Customer Relationship Management Software Collection
Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Why these techniques?

Missing authentication in public-facing School Management System (CRM) enables remote exploitation for initial access and privilege escalation to admin functions, unauthorized collection from CRM software, and manipulation of stored data like student/teacher records.

NVD Description

A vulnerability was found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown part. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could…

more

be used. This product adopts a rolling release strategy to maintain continuous delivery

Deeper analysisAI

CVE-2025-11661 is a missing authentication vulnerability (CWE-287, CWE-306) discovered in the ProjectsAndPrograms School Management System up to commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The issue affects an unknown part of the software, where manipulation leads to authentication bypass.

Attackers can exploit this vulnerability remotely without privileges or user interaction, as indicated by its CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Unauthenticated remote actors can achieve limited impacts on confidentiality, integrity, and availability. A public exploit exists and could be used against vulnerable instances.

Advisories documented on VulDB (ctiid.328078, id.328078, submit.665611) and a GitHub issue (qqy-123/cve/issues/6) detail the flaw, published on 2025-10-13. The product follows a rolling release strategy for continuous delivery, implying security practitioners should monitor the repository for updates beyond the affected commit.

Details

CWE(s)

Affected Products

oranbyte
school management system
1.0

CVEs Like This One

CVE-2025-58443Shared CWE-287, CWE-306
CVE-2026-6577Shared CWE-287, CWE-306
CVE-2026-40344Shared CWE-287, CWE-306
CVE-2026-6582Shared CWE-287, CWE-306
CVE-2026-4562Shared CWE-287, CWE-306
CVE-2026-3053Shared CWE-287, CWE-306
CVE-2026-5000Shared CWE-287, CWE-306
CVE-2026-6129Shared CWE-287, CWE-306
CVE-2025-11942Shared CWE-287, CWE-306
CVE-2026-7042Shared CWE-287, CWE-306

References