CVE-2026-25812CWE-352

PlaciPy is Missing CSRF Protection on State-Changing Endpoints

Critical · published February 9, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-02-09T21:03Z
EPSS history
Timeline
  • 09 FEB 21:03Z
    PlaciPy is Missing CSRF Protection on State-Changing Endpoints
    cvelistv5