Unrated severityNVD Advisory· Published Feb 9, 2026· Updated Feb 10, 2026
PlaciPy Code Execution Allowed Without Assessment Active State Validation
CVE-2026-25809
Description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
Affected products
1- Praskla-Technology/assessment-placipyv5Range: = 1.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-cc32-rp29-w9x7mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.