CVE-2026-85602: Reliance on Untrusted Inputs in a Security Decision

The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...

CVE-2025-2220

A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odysseycontactform/odysseycontactform.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key...

PT-2025-10989

Name of the Vulnerable Software and Affected Versions: Odyssey CMS versions up to 10.34 Description: A key management error can occur due to the manipulation of the g-recaptcha-response argument in an unknown function of the file /modules/odyssey contact form/odyssey contact form.php of the...

CVE-2025-2220: Undefined Security Weakness

A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odysseycontactform/odysseycontactform.php of the component reCAPTCHA Handler. The manipulation of the argument g-recaptcha-response leads to key...

CVE-2023-6963

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recaptcha-response' from the 'data' array...

CVE-2023-6963: Guessable CAPTCHA

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recaptcha-response' from the 'data' array...

DRIVE.NET, Inc.: [www.drive2.ru] CSRF through FCTX token bypass

During login on the login page, login is attempted through the FCTX token. In addition, the login page was implemented through g-recaptcha-response captcha, but an attacker can bypass g-recaptcha-response captcha without FCTX tokens, and login CSRF is possible. The issue was fixed by enabling the...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process

Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...