by Kastro
Paper/Archive/CVE-2026-25809

CVE-2026-25809

Praskla-Technology assessment-placipy — PlaciPy Code Execution Allowed Without Assessment Active State Validation

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 29.8.298 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.

Affected

ProductAffectedFixed inSource
assessment-placipy= 1.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-cc32-rp29-w9x7