Confidential information on thousands of students could have been breached after a teenager revealed that a software programme used by schools had a shared login.