Schule · Schule · CVE-2025-48375
**Name of the Vulnerable Software and Affected Versions**
Schule versions prior to 1.0.1
**Description**
The issue concerns a lack of proper rate limiting controls in the file forgot password.php, which is responsible for email-based OTP generation. This allows attackers to abuse the OTP request functionality, potentially leading to denial-of-service (DoS) conditions or facilitating user harassment through email flooding.
**Recommendations**
For versions prior to 1.0.1, update to version 1.0.1 to resolve the issue. As a temporary workaround, consider implementing rate limiting controls on the forgot password.php file or equivalent endpoint to minimize the risk of exploitation. Restrict access to the forgot password.php file to prevent abuse of the OTP request functionality until the update is applied.