CVE-2026-25812
Undergoing Analysis Undergoing Analysis - In Progress

CSRF Vulnerability in PlaciPy 1.0.0 Enables Credentialed CORS Abuse

Publication date: 2026-02-09

Last updated on: 2026-02-18

Assigner: GitHub, Inc.

Description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS requests but does not implement any CSRF protection mechanism.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-09
Last Modified
2026-02-18
Generated
2026-07-06
AI Q&A
2026-02-10
EPSS Evaluated
2026-07-05
NVD
CVE-2026-25812

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prasklatechnology placipy 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in PlaciPy version 1.0.0 arises because the application allows credentialed Cross-Origin Resource Sharing (CORS) requests but does not have any Cross-Site Request Forgery (CSRF) protection mechanisms in place.

This means that while the application accepts requests from other origins with credentials (like cookies or HTTP authentication), it does not verify whether these requests are intentionally made by the authenticated user, leaving it open to CSRF attacks.

Impact Analysis

Because PlaciPy accepts credentialed CORS requests without CSRF protection, an attacker could trick an authenticated user into making unintended requests to the application.

This can lead to unauthorized actions being performed on behalf of the user without their consent, potentially compromising user data or application integrity.

Given the high CVSS score (9.3), the impact is severe, indicating that the vulnerability can be exploited remotely without user interaction and can lead to significant security breaches.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart