Weakness (CWE)
CWE-804: Guessable CAPTCHA
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Source: MITRE CWE-804
17 results · Clear filters · Feed
-
Medium 6.9
Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default conf…
-
Medium 5.3
NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value…
-
Medium 6.5
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lea…
-
Medium 4.3
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensit…
-
Medium 5.3
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-charact…
-
Medium 6.5
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Atta…
-
Medium 5.3
WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to genera…
-
Medium 5.3
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generat…
-
Medium 5.4
WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability
Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through <= 1.7.9.
-
Medium 5.3
atjiu pybbs Verification Code login Captcha
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the atta…
-
Medium 4.2
DNN allows the possibility of bypassing Captcha
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily re…
-
Medium 5.3
Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass
The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.
-
Medium 5.3
WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability
Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.
-
Medium 5.3
WordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerability
Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects Captcha by BestWebSoft: from n/a through 5.2.0.
-
Medium 5.3
Getwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recapt…
-
Medium 5.3
Improper Restriction of Excessive Authentication Attempts in answerdev/answer
Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
-
Medium 5.3
Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.