PT-2026-6779 · Placipy · Placipy

Th3Gowtham · Published 2026-02-06 · Updated 2026-02-15 · CVE-2026-25753

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PlaciPy version 1.0.0

Description PlaciPy, a placement management system for educational institutions, uses a hard-coded, static default password for all newly created student accounts in version 1.0.0. This allows for mass account takeover, enabling an attacker to log in as any student with knowledge of the password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2026-25753

GHSA-6537-CF56-J9W2

Affected Products

Placipy

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25753.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25753 · Vendor Advisory
• https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-6537-cf56-j9w2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25753 · Security Note
• https://twitter.com/CVEnew/status/2019857596694294756 · Twitter Post
• https://twitter.com/0dayPublishing/status/2019851485723365614 · Twitter Post
• https://t.me/CVEtracker/43950 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2022995524811685932 · Twitter Post