Vulnerabilities

TI-2026-20915 CVE-2026-25875

PlaciPy Admin Privilege Escalation via Trusted JWT Claims

MEDIUM 46

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00342 Published 2026-02-09 No fix listed CWE-863

TI-2026-20877 CVE-2026-25814

NoSQL Injection Risk via Unsanitized Query Parameters

MEDIUM 46

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-02-09 No fix listed CWE-74

TI-2026-20876 CVE-2026-25813

PlaciPy Exposes Sensitive Data via Application Logs

MEDIUM 43

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00304 Published 2026-02-09 No fix listed CWE-532

TI-2026-20875 CVE-2026-25812

PlaciPy is Missing CSRF Protection on State-Changing Endpoints

MEDIUM 45

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00173 Published 2026-02-09 No fix listed CWE-352

TI-2026-20874 CVE-2026-25811

PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

LOW 24

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00319 Published 2026-02-09 No fix listed CWE-863

TI-2026-20872 CVE-2026-25809

PlaciPy Code Execution Allowed Without Assessment Active State Validation

LOW 24

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00368 Published 2026-02-09 No fix listed CWE-285

TI-2026-20869 CVE-2026-25806

PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)

LOW 24

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00243 Published 2026-02-09 No fix listed CWE-862

TI-2026-20873 CVE-2026-25810

PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts

LOW 24

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-02-09 No fix listed CWE-862

TI-2026-20916 CVE-2026-25876

PlaciPy is Missing Authorization on Assessment Results Endpoint

LOW 24

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-02-09 No fix listed CWE-862

TI-2026-20821 CVE-2026-25753

PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

MEDIUM 48

PlaciPy is a placement management system designed for educational institutions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00387 Published 2026-02-06 No fix listed CWE-259

Vulnerabilities

Filters