CVE-2026-25753 CRITICAL

CVE-2026-25753: PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)

Vendor Praskla-Technology
Product assessment-placipy
Weakness CWE-259
Published February 6, 2026
Last update February 9, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.

Key dates

02Disclosure timeline

February 6, 2026 CVE published
February 9, 2026 Record updated