Once I found out an unprotected folder in my school which is used to store sensitive data.

It was open to any administrator there.

We copied the Question Papers, Edited the attendance, and Even changed the Marks.

We were able to extract photos of students from the database and retrieve stored passwords