Vulnerabilidades do Prasklatechnology Placipy

CVE-2026-25875 Crítica · 9.8 CWE-863 09/02/2026

PlaciPy Admin Privilege Escalation via Trusted JWT Claims

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.

CVE-2026-25814 Crítica · 9.8 CWE-74 09/02/2026

NoSQL Injection Risk via Unsanitized Query Parameters

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.

CVE-2026-25813 Alta · 7.5 CWE-532 09/02/2026

PlaciPy Exposes Sensitive Data via Application Logs

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.

CVE-2026-25812 Alta · 8.8 CWE-352 09/02/2026

PlaciPy is Missing CSRF Protection on State-Changing Endpoints

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

CVE-2026-25811 Crítica · 9.1 CWE-863 09/02/2026

PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.

CVE-2026-25876 Crítica · 9.1 CWE-862 09/02/2026

PlaciPy is Missing Authorization on Assessment Results Endpoint

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.

CVE-2026-25810 Crítica · 9.1 CWE-862 09/02/2026

PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).

CVE-2026-25809 Crítica · 9.8 CWE-285 09/02/2026

PlaciPy Code Execution Allowed Without Assessment Active State Validation

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.

CVE-2026-25806 Média · 6.5 CWE-862 09/02/2026

PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do not enforce authorization. The application does not verify whether the authenticated user owns the student record being accessed, has an administrative / staff role, or is permitted to modify or delete the target student.

CVE-2026-25753 Crítica · 9.8 CWE-259 06/02/2026

Prasklatechnology PlaciPy 1.0.0: senha padrão fixa (hard-coded) em contas de estudantes

PlaciPy é um sistema de gestão de colocação profissional para instituições de ensino. Na versão 1.0.0, a aplicação usa uma senha padrão fixa e estática (hard-coded) para todas as contas de estudantes recém-criadas. Isso resulta em tomada de contas em massa, permitindo que qualquer atacante faça login como qualquer estudante quando a senha for conhecida.