PlaciPy version 1.0.0 lacks CSRF protection on endpoints that alter state. Because the application accepts credentialed CORS requests without a CSRF token, an attacker can forge requests from a malicious site that a legitimate user is logged into, causing unauthorized changes to placement data or system settings.

The affected product is Praskla-Technology’s PlaciPy 1.0.0, a placement management system for educational institutions. No other versions are listed as affected.

With a CVSS score of 9.3 the vulnerability is critical, but the EPSS score indicates exploitation likelihood remains below 1%. The app trusts cross‑origin requests if credentials are present, so an attacker could exploit the flaw through a phishing page or malicious script. The vulnerability is not included in CISA’s KEV catalog, but it remains a high‑risk issue.