CVE Intelligence
Analysis AI-assisted

CVE-2026-25753: Prasklatechnology PlaciPy 1.0.0 Hard-coded Default Password in Student Accounts

CVE-2026-25753 affects Prasklatechnology PlaciPy version 1.0.0, a placement management system for educational institutions. New student accounts receive a hard-coded, static default password, which enables mass account takeover once that password is known. NVD rates it CVSS 3.1 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

PlacIPy is a placement management system for educational institutions. According to the record, version 1.0.0 assigns a hard-coded, static default password to every newly created student account, so all such accounts begin with the same credential.

Impact

  • Anyone who knows the default password can sign in as any student account that still uses it.
  • The record describes this as mass account takeover. It does not state which student data or application functions would be exposed.
  • NVD scores the issue CVSS 3.1 9.8 (Critical) with high confidentiality, integrity and availability impact. The GitHub CNA scores it CVSS 4.0 9.3.

Affected products and versions

  • Prasklatechnology PlaciPy, version 1.0.0, as listed in the record.
  • The record lists no other affected versions and no fixed version.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00561, with a percentile of 0.45121.

Remediation and mitigation

  • The record's only reference is a vendor advisory tagged as mitigation: GHSA-6537-cf56-j9w2. Consult it for the vendor's guidance.
  • Until a fixed version is confirmed, check whether any accounts still use the default password and require a unique credential reset for each one.
  • Stop creating accounts with a shared static password. Issue per-user temporary credentials through a secure channel and require a change at first login.
  • Limit network exposure of the application where possible.

Detection guidance

  • Audit account records created by affected versions to identify accounts that may still hold the default credential.
  • Review authentication logs for successful logins from unfamiliar sources or for a single source accessing many student accounts.

Limitations of the available information

  • The record gives no fixed version and no details on the default password's value or on exposed data.
  • Whether the vendor's mitigation fully removes the default password is unknown from the record alone.
  • The EPSS date in the record is 2026-10-13, which is reported as provided.

Frequently asked questions

What is the core problem in CVE-2026-25753?

PlaciPy version 1.0.0 gives every newly created student account the same hard-coded, static default password. Anyone who knows that password can log in to those accounts.

Is there a fixed version listed?

No. The record lists no fixed version. It points to a vendor advisory tagged as mitigation, which should be consulted for guidance.

Is this vulnerability known to be exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.