CVE-2026-25811: falha de média gravidade em Praskla-Technology assessment-placipy
PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Praskla-Technology · assessment-placipyCVEs relacionadas — Praskla-Technology assessment-placipy
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25814CRITICALNoSQL Injection Risk via Unsanitized Query ParametersEPSS 0.4%CVE-2026-25753CRITICALPlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)EPSS 0.4%CVE-2026-25809MEDIUMPlaciPy Code Execution Allowed Without Assessment Active State ValidationEPSS 0.4%CVE-2026-25875CRITICALPlaciPy Admin Privilege Escalation via Trusted JWT ClaimsEPSS 0.3%CVE-2026-25813HIGHPlaciPy Exposes Sensitive Data via Application LogsEPSS 0.3%CVE-2026-25810MEDIUMPlaciPy is Missing Object-Level Authorization in student.submission.routes.tsEPSS 0.3%