Malicious code in ndmushdkeqe (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mn3sadkoiewu (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in mn2adskhweox (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15617 Malicious code in skxcmwuncbg2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15609 Malicious code in mn2adskhweox (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-45734

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

EUVD-2026-61014

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734

MyBB versions before 1.8.40 fail to call captcha::invalidate_captcha() in five endpoints (contact.php, member.php actions, sendthread.php), allowing a valid CAPTCHA response to be replayed for low-integrity abuse (spam, password reset floods). CVSS 5.3 MEDIUM. Fixed in 1.8.40; no in-the-wild expl...

CVE-2026-46482

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

EUVD-2026-61052

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482 MyBB: Security Question insufficient validation

Impact The registration component does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Details The public Registration workflow member.php?action=doregister...

CVE-2026-46482

MyBB's registration flow (member.php?action=do_register) accepts a hidden question_id field and validates the Security Question answer without a fail-closed fallback. A blank, forged, or expired question_id lets the request proceed, enabling CAPTCHA bypass for automated account creation. CVSS 3.1...