Skip to content
OpenAdvisories

Vendor

Praskla-Technology

10 known vulnerabilities.

Products

assessment-placipy 10
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-25875

    PlaciPy Admin Privilege Escalation via Trusted JWT Claims

    PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.

    Praskla-Technology assessment-placipy
  • Critical 9.3
    CVE-2026-25814

    NoSQL Injection Risk via Unsanitized Query Parameters

    PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.

    Praskla-Technology assessment-placipy
  • Critical 9.3
    CVE-2026-25812

    PlaciPy is Missing CSRF Protection on State-Changing Endpoints

    PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

    Praskla-Technology assessment-placipy
  • Critical 9.3
    CVE-2026-25753

    PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

    PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker t…

    Praskla-Technology assessment-placipy