CVE-2025-40916
BaseFortify
Publication date: 2025-06-16
Last updated on: 2025-06-16
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
| CWE-804 | The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl, where it uses a weak random number source for generating the captcha. Specifically, it uses the built-in rand() function to generate both the captcha text and image noise, which is insecure and can be predicted or bypassed.
How can this vulnerability impact me? :
Because the captcha uses a weak random number generator, attackers may be able to predict or bypass the captcha protection. This can allow automated bots to circumvent the captcha, potentially leading to abuse of the protected service such as spam, brute force attacks, or unauthorized access.