The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Volume of CVEs assigned to CWE-804 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-50850HIGH An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an att | Jul 31, 2025 | 8.6 | 29 | NO | NO |
CVE-2026-13082MEDIUM GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.
The random method creates the challenge text used for the CAPTCHA by sampling characters from an arr | Jul 17, 2026 | 5.3 | 28 | NO | NO |
CVE-2025-40916CRITICAL Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.
That version uses the built-in rand() function for generating th | Jun 16, 2025 | 9.1 | 28 | NO | NO |
CVE-2024-23566MEDIUM HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated att | Jul 17, 2026 | 6.5 | 27 | NO | NO |
CVE-2022-1801HIGH The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the pag | Jun 20, 2022 | 7.5 | 25 | NO | NO |
CVE-2024-23567MEDIUM HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed | Jul 17, 2026 | 4.3 | 24 | NO | NO |
CVE-2026-49953MEDIUM Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limi | Jun 15, 2026 | 6.5 | 24 | NO | NO |
CVE-2025-70129MEDIUM If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for art | Mar 10, 2026 | 5.3 | 20 | NO | NO |
CVE-2025-8546MEDIUM A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. T | Aug 5, 2025 | 5.3 | 20 | NO | NO |
CVE-2026-40935MEDIUM WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with no clamping | Apr 21, 2026 | 5.3 | 19 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.