PR
Vendor
Praskla-Technology
10
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25875 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Admin Privilege Escalation via Trusted JWT Claims |
| CVE-2026-25814 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | NoSQL Injection Risk via Unsanitized Query Parameters |
| CVE-2026-25813 | AS assessment-placipy Praskla-Technology | 7.5 | Feb 9 | PlaciPy Exposes Sensitive Data via Application Logs |
| CVE-2026-25812 | AS assessment-placipy Praskla-Technology | 8.8 | Feb 9 | PlaciPy is Missing CSRF Protection on State-Changing Endpoints |
| CVE-2026-25811 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) |
| CVE-2026-25809 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 9 | PlaciPy Code Execution Allowed Without Assessment Active State Validation |
| CVE-2026-25806 | AS assessment-placipy Praskla-Technology | 6.5 | Feb 9 | PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) |
| CVE-2026-25810 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts |
| CVE-2026-25876 | AS assessment-placipy Praskla-Technology | 9.1 | Feb 9 | PlaciPy is Missing Authorization on Assessment Results Endpoint |
| CVE-2026-25753 | AS assessment-placipy Praskla-Technology | 9.8 | Feb 6 | PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover) |