CVE-2026-25811

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application derives the tenant identifier directly from the email domain provided by the user, without validating domain ownership or registration. This allows cross-tenant data access.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-258128.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the application enables credentialed CORS CVE-2026-258137.5PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive dataCVE-2026-258149.8PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passeCVE-2026-258153.2Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild fCVE-2026-258178.8HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haCVE-2026-258189.1HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haCVE-2026-258197.5HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 alCVE-2026-25826.5The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in allCVE-2026-258239.8HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haCVE-2026-258252.7An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set tCVE-2026-258264.9An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable filCVE-2026-258272.3An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what pa
CVE-2026-25811: Critical severity, CVSS 9.1 | Vulnix