PT-2025-49759

Name of the Vulnerable Software and Affected Versions 1Panel versions 2.0.13 and below Description 1Panel is a web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to bypass CAPTCHA verification by manipulating a client-controlled...

CVE-2025-66507: Client-Side Enforcement of Server-Side Security

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA...

1Panel – CAPTCHA Bypass via Client-Controlled Flag

Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed,...

GHSA-QMG5-V42X-QQHQ 1Panel – CAPTCHA Bypass via Client-Controlled Flag

Summary A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed,...

1Panel – CAPTCHA Bypass via Client-Controlled Flag

A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling...

ALTCHA 安全漏洞

ALTCHA is a self-hosted CAPTCHA software from ALTCHA Open Source. A security vulnerability exists in ALTCHA that stems from a cryptanalysis flaw that could lead to the recovery of random numbers through mathematical derivation...

1Panel – CAPTCHA Bypass via Client-Controlled Flag

A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling...

KDE Connect 安全特征问题漏洞

KDE Connect is a software from the KDE community that connects cell phones and computers. A Security Feature Issue vulnerability exists in versions of KDE Connect prior to 2025-04-18, which stems from a captcha protocol that uses only 8 characters, which could lead to brute-force breaking attacks...

Cross-site Scripting

pyloadng is vulnerable to Cross-site Scripting. The vulnerability is due to unsafe handling of untrusted parameters in the Captcha and CNL endpoints, allowing attackers to inject malicious content or manipulate request processing, leading to Cross-site Scripting or other unintended behaviors...

COGNITION: From Evaluation to Defense against Multimodal LLM CAPTCHA Solvers

This paper studies how multimodal large language models MLLMs undermine the security guarantees of visual CAPTCHA. We identify the attack surface where an adversary can cheaply automate CAPTCHA solving using off-the-shelf models. We evaluate 7 leading commercial and open-source MLLMs across 18...

Blogile 安全漏洞

Blogile is a Node.js blogging system. A security vulnerability exists in Blogile, which stems from a weak CAPTCHA generation mechanism and a lack of rate limiting, which could lead to a brute force attack...

MAL-2025-190568 Malicious code in captcha-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 358456d344b5a4b2a92cb9b9094bafcf797200b5a0b6549e46175fbbfff70fa4 The package captcha-paypal was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-198096

Malicious code in captcha-paypal npm...

Malicious code in captcha-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 358456d344b5a4b2a92cb9b9094bafcf797200b5a0b6549e46175fbbfff70fa4 The package captcha-paypal was found to contain malicious code. Source: ossf-package-analysis...

adaptivewaf

Adaptive Web Application Firewall WAF - v1 Rule-Based A hob...

Fake CAPTCHA sites now have tutorial videos to help victims install malware

Early on in 2025, I described how criminals used fake CAPTCHA sites and a clipboard hijacker to provide instructions for website visitors that would effectively infect their own machines with an information stealer known as the Lumma Stealer. ClickFix is the name researchers have since given to...

WordPress OOPSpam Anti-Spam plugin IP Header Forgery Vulnerability

WordPress OOPSpam Anti-Spam plugin is an anti-spam plugin designed for WordPress that protects forms and comments from spam through AI and machine learning techniques without the use of CAPTCHA validation. The WordPress OOPSpam Anti-Spam plugin suffers from an IP header forgery vulnerability that...

CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

CVE-2025-12094: Protection Mechanism Failure

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments No CAPTCHA plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers such as CF-Connecting-IP, X-Forwarded-For,...

IOFIT AG Life Logger Android App 安全漏洞

IOFIT AG Life Logger Android App is a sports app from IOFIT Japan. A security vulnerability exists in IOFIT AG Life Logger Android App v1.0.2.72 and earlier versions, which stems from improper access control and a predictable CAPTCHA, and could lead to account disclosure and misuse of cloud...