CVE-2026-25753

PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

State: Published
Severity: 9.3 Critical
Published: Feb 6, 2026
Updated: Feb 9, 2026
Reserved: Feb 5, 2026

Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-259 Use of Hard-coded Password

Affected Products

Product	Versions
assessment-placipyPraskla-Technology	<= 1.0.0Affected

References

https://github.com/Praskla-Technology/assessment-placipy/security/advisories/GHSA-6537-cf56-j9w2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.