Vendor
Praskla-Technology
10 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Medium 5.3
PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allo…
-
Medium 5.3
PlaciPy Code Execution Allowed Without Assessment Active State Validation
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has star…
-
Medium 5.3
PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authent…
-
Medium 5.3
PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
-
Medium 5.3
PlaciPy is Missing Authorization on Assessment Results Endpoint
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used …