PT-2026-7154 · Placipy · Placipy

Devdeep781 + 2 · Publicado 2026-02-09 · Atualizado 2026-02-09 · CVE-2026-25806

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0

Description PlaciPy is a placement management system for educational institutions. The GET /api/students/:email, PUT /api/students/:email/status, and DELETE /api/students/:email routes do not enforce authorization. The application does not verify if the authenticated user owns the student record, has an administrative role, or is permitted to modify or delete the student data. The vulnerable parameter is email.

Recommendations Implement authorization checks for the GET /api/students/:email, PUT /api/students/:email/status, and DELETE /api/students/:email routes to ensure that only authorized users can access and modify student records.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-25806

GHSA-99GR-8933-3VWJ

Produtos afetados

Placipy

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25806.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25806 · Aviso do Fabricante
• https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-99gr-8933-3vwj · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2020972046289674537 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25806 · Nota de Segurança