Advisories · Technology
Praskla-Technology assessment-placipy.
Every CVE that names Praskla-Technology assessment-placipy among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.3 CriticalCritical · CVSS 9+
PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
NoSQL Injection Risk via Unsanitized Query Parameters
- Praskla-Technology assessment-placipy
- Other injection
- CVSS 8.7 High
PlaciPy Exposes Sensitive Data via Application Logs
- Praskla-Technology assessment-placipy
- Information disclosure
- CVSS 9.3 CriticalCritical · CVSS 9+
PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- Praskla-Technology assessment-placipy
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure)
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 5.3 Medium
PlaciPy Code Execution Allowed Without Assessment Active State Validation
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 5.3 Medium
PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR)
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 5.3 Medium
PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 5.3 Medium
PlaciPy is Missing Authorization on Assessment Results Endpoint
- Praskla-Technology assessment-placipy
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- Praskla-Technology assessment-placipy
- Hard-coded credentials