CVE-2026-25753 — PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly create…
Published: 2026-02-06 · CVSS: 9.3 · CVSS 4.0
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application uses a hard-coded, static default password for all newly created student accounts. This results in mass account takeover, allowing any attacker to log in as any student once the password is known.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7