What’s Vulnerable › Vulnerabilities

CVE-2026-25809: PlaciPy Code Execution Allowed Without Assessment Active State Validation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-09 · updated 2026-06-17
• Weakness: CWE-285

Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.

Affected products

• Praskla-Technology assessment-placipy: 1.0.0

References

• https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-cc32-rp29-w9x7

Get alerted when CVE-2026-25809 or the next vulnerability affects your stack