CVE-2026-25809: medium-severity vulnerability in Praskla-Technology assessment-placipy
PlaciPy Code Execution Allowed Without Assessment Active State Validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Praskla-Technology · assessment-placipyRelated CVEs — Praskla-Technology assessment-placipy
In the same product, most dangerous first.
CVE-2026-25814CRITICALNoSQL Injection Risk via Unsanitized Query ParametersEPSS 0.4%CVE-2026-25753CRITICALPlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)EPSS 0.4%CVE-2026-25875CRITICALPlaciPy Admin Privilege Escalation via Trusted JWT ClaimsEPSS 0.3%CVE-2026-25811MEDIUMPlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)EPSS 0.3%CVE-2026-25813HIGHPlaciPy Exposes Sensitive Data via Application LogsEPSS 0.3%CVE-2026-25810MEDIUMPlaciPy is Missing Object-Level Authorization in student.submission.routes.tsEPSS 0.3%