CVE-2026-40935

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/getCaptcha.php accepts the CAPTCHA length ql directly from the query string with no clamping or sanitization, letting any unauthenticated client force the server to generate a 1-character CAPTCHA word. Combined with...

EUVD-2010-5296

Malware in sbrugna...

CVE-2025-26312

SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter...

PT-2025-11288

Name of the Vulnerable Software and Affected Versions: SendQuick Entera versions prior to 11HF5 Description: The issue allows for CAPTCHA bypass via the captcha parameter. Recommendations: For versions prior to 11HF5, consider disabling the CAPTCHA functionality until a patch is available. Restri...

Directory traversal

Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captchachalange parameter...

PT-2012-4041

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to "module.php". This can be exploited through cross-site request...