CVE-2026-25809CWE-285

PlaciPy Code Execution Allowed Without Assessment Active State Validation

Medium · published February 9, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-02-09T20:58Z
EPSS history
Timeline
  • 09 FEB 20:58Z
    PlaciPy Code Execution Allowed Without Assessment Active State Validation
    cvelistv5