Unsanitized query parameters in PlaciPy version 1.0.0 are directly incorporated into DynamoDB queries, creating a NoSQL injection vulnerability. An attacker who can submit crafted input can manipulate the query to read, alter, or delete sensitive student and institutional data, compromising confidentiality and integrity. The flaw aligns with injection weaknesses (CWE‑74).

The affected product is Praskla‑Technology Assessment‑Placipy version 1.0.0, used by educational institutions for placement management. No other versions are currently listed as vulnerable. The application interacts with an Amazon DynamoDB backend.

With a CVSS score of 9.3 the vulnerability is considered severe, though the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through exposed web or API endpoints where query parameters are processed; no authentication or high‑privilege requirement is mentioned, suggesting that even unauthenticated users could exploit if the endpoint is reachable.