Guessable CAPTCHA
CWE-804
The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4.
Latest Guessable CAPTCHA vulnerabilities
- 8.6 High severity
Cs-cart: Improper Access Control
An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords
- 9.1 Critical severity
Mojolicious::Plugin::CaptchaPNG: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
- 7.5 High severity
Very Simple Contact Form: Improper Authentication
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page