Th3Gowtham

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy is a placement management system for educational institutions. The GET `/api/students/:email`, PUT `/api/students/:email/status`, and DELETE `/api/students/:email` routes do not enforce authorization. The application does not verify if the authenticated user owns the student record, has an administrative role, or is permitted to modify or delete the student data. The vulnerable parameter is `email`. **Recommendations** Implement authorization checks for the GET `/api/students/:email`, PUT `/api/students/:email/status`, and DELETE `/api/students/:email` routes to ensure that only authorized users can access and modify student records.

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy is a placement management system for educational institutions. The code evaluation endpoint in version 1.0.0 lacks validation of the assessment lifecycle state before allowing execution. Specifically, it does not verify if an assessment has started, is not expired, or if the submission window is open. The vulnerable endpoint is `/api/v1/assessments/{assessment id}/evaluate` and the vulnerable variable is `assessment id`. The `evaluateAssessment()` function is involved in this issue. **Recommendations** Apply updates to address the missing validation checks in the code evaluation endpoint. As a temporary workaround, restrict access to the `/api/v1/assessments/{assessment id}/evaluate` endpoint until a fix is available.

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy is a placement management system for educational institutions. Version 1.0.0 does not enforce object-level authorization (ownership checks) despite verifying authentication in the `backend/src/routes/student.submission.routes.ts` file. This allows unauthorized access to student submissions. The affected route is `student.submission.routes.ts`. **Recommendations** Implement object-level authorization checks to ensure users can only access their own submissions.

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy is a placement management system for educational institutions. Version 1.0.0 logs sensitive data directly to the console output without any masking or redaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy is a placement management system for educational institutions. Version 1.0.0 allows user-controlled query parameters to be passed directly into DynamoDB query/filter construction without validation or sanitization. This could lead to unauthorized data access or modification. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PlaciPy version 1.0.0 **Description** PlaciPy, a placement management system for educational institutions, uses a hard-coded, static default password for all newly created student accounts in version 1.0.0. This allows for mass account takeover, enabling an attacker to log in as any student with knowledge of the password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.