Skip to content
Prasklatechnology Placipy vulnerabilities
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy Admin Privilege Escalation via Trusted JWT Claims
CVE-2026-25875
9.3 Critical
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
NoSQL Injection Risk via Unsanitized Query Parameters
CVE-2026-25814
9.3 Critical
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy Exposes Sensitive Data via Application Logs
CVE-2026-25813
8.7 High
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy is Missing CSRF Protection on State-Changing Endpoints
CVE-2026-25812
9.3 Critical
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
CVE-2026-25811
5.3 Medium
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy Code Execution Allowed Without Assessment Active State Validation
CVE-2026-25809
5.3 Medium
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)
CVE-2026-25806
5.3 Medium
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
CVE-2026-25810
5.3 Medium
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy is Missing Authorization on Assessment Results Endpoint
CVE-2026-25876
5.3 Medium
-
prasklatechnology placipy, praskla-technology assessment-placipy +1 more
PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
CVE-2026-25753
9.3 Critical