WordPress Captcha Plugin < 4.4.5 Backdoor Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112155";...

WordPress Captcha Plugin Backdoor

A backdoor vulnerability exists in WordPress Captcha plugin. Successful exploitation of this vulnerability allows remote attackers to change the effected site's content...

WordPress Captcha plugin <=4.4.4 - Backdoored

Backdoor found by WordFence team in WordPress Captcha plugin versions 4.3.6–4.4.4. Solution WordPress plugin repository team patched the plugin, but you need to decide on your own to use this plugin further or not...

Hidden Backdoor Found In WordPress Captcha Plugin Affects Over 300,000 Sites

Buying popular plugins with a large user-base and using it for effortless malicious campaigns have become a new trend for bad actors. One such incident happened recently when the renowned developer BestWebSoft sold a popular Captcha WordPress plugin to an undisclosed buyer, who then modified the...

Captcha 4.3.6–4.4.4 - Backdoored

The captcha WordPress plugin was affected by a Backdoored security vulnerability...

MicroTalk App Has SMS Bombing Vulnerability

MicroTalk App is a calling software. MicroTalk APP has SMS bombing vulnerability. The attacker sends unlimited CAPTCHA to the cell phone by catching packets through the forget password function, consumes server resources, and carries out SMS bombing...

base64Captcha

A flexible and various captcha package !Testhttps://github...

SMS Bombing Vulnerability in Xiaofeng Air Ching App Android Version

Ltd. developed with the work of the Xiao Feng Air Dorothy system APP, mainly used to monitor the indoor air quality and Xiao Feng Air Dorothy internal and external machine running status, monitoring items including PM2.5, formaldehyde, oxygen, temperature and humidity, and can be through the APP...

Securimage HTML Injection Vulnerability

Securimage is an open source free PHP CAPTCHA script for generating complex CAPTCHA images and CAPTCHA code. An HTML injection vulnerability exists in Securimage 3.6.4 and earlier versions. A remote attacker can send the '$SERVER'HTTPUSERAGENT'' parameter to the exampleform.ajax.php or...

Logic design flaws in Tap Tech's smart CAPTCHA system

Smart CAPTCHA system is a new generation of Internet CAPTCHA system. A logical design vulnerability exists in the Smart CAPTCHA System of Point and Click Technology. An attacker can bypass the graphical CAPTCHA of the mouse-click method by modifying the status code, which can be utilized to bypas...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Google’s reCaptcha Cracked Again

Google’s reCaptcha service has been cracked by a group of University of Maryland researchers who devised an automated attack that can break the service with 85 percent accuracy. The researchers created a tool called unCaptcha that is able to abuse the audio challenge option of Google’s reCaptcha ...

Microticket Mobile App Has Logic Design Flaws

Microticket Mobile App is an e-ticketing App developed by the R&D team of Beijing Microticket E-commerce Co. There is a logic design vulnerability in Microticket Mobile App. Attackers can utilize this vulnerability to replay the packets of sending CAPTCHA without restriction and bombard the clien...

Low Resource Defeat of reCaptcha’s Audio Challenge: unCaptcha

Across the Internet, hundreds of thousands of sites rely on Google’s reCaptcha system for defense against bots in fact, Devpost uses reCaptcha when creating a new account. After a Google research team demonstrated a near complete defeat of the text reCaptcha in 2012, the reCaptcha system evolved ...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Short summary Hi, I noticed that the following report has been fixed and closed, however the bug has reappeared in different parameters: https://hackerone.com/reports/204208 Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumptio...

DorkNet - Selenium Powered Python Script To Automate Searching For Vulnerable Web Apps

Selenium powered Python script to automate searching the web for vulnerable applications. DorkNet can take a single dork or a list of dorks as arguments. After the proper command line arguments have been passed, the script will use Selenium and Geckodriver to find the results we want and save the...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

Drupal CAPTCHA Module Denial of Service Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote denial of service vulnerability exists in the CAPTCHA module of Drupal. An attacker can exploit this vulnerability to cause a denial of service...

XiaoCMS admin\controller\login.php page has a logical design vulnerability

XiaoCms Enterprise Builder is a small, flexible, simple and easy-to-use lightweight cms based on PHP+Mysql architecture. XiaoCMS admin\controller\login.php page has a logical design vulnerability. The vulnerability is due to the CAPTCHA judgment and restriction of the login function, the attacker...

Lend a Little Loan App Has Arbitrary User Registration Vulnerability

Lend a little with a loan app is an emergency loan platform. There is an arbitrary user registration vulnerability in Lend a Little with Loan APP. Attackers can register any account by grabbing packets and blasting CAPTCHA...