Placipy vulnerabilities
9 known vulnerabilities in Placipy from Prasklatechnology. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
assessment-placipy: Incorrect Authorization
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The admin authorization middleware trusts client-controlled JWT claims (role and scope) without enforcing server-side role verification.
- 9.8 Critical severity
assessment-placipy: Improper Neutralization of Special Elements in Output Used by a Downstream Component
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.
- 7.5 High severity
assessment-placipy: Insertion of Sensitive Information into Log File
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
- 8.8 High severity
assessment-placipy: Cross-Site Request Forgery
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.
- 9.1 Critical severity
assessment-placipy: Incorrect Authorization
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allow
- 9.1 Critical severity
assessment-placipy: Missing Authorization
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used t
- 9.1 Critical severity
assessment-placipy: Missing Authorization
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).
- 9.8 Critical severity
assessment-placipy: Improper Authorization
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has start
- 9.8 Critical severity
assessment-placipy: Use of Hard-coded Password
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to