CVE-2025-40916
CRITICALMojolicious::Plugin::CaptchaPNG 1.05 - Info Disclosure
Title source: llmDescription
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
References (4)
Core 4
Core References
Various Sources
https://metacpan.org/pod/perlfunc#rand
Scores
CVSS v3
9.1
EPSS
0.0033
EPSS Percentile
24.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-338
CWE-804
Status
published
Products (1)
GRYPHON/Mojolicious::Plugin::CaptchaPNG
1.05
Published
Jun 16, 2025
Tracked Since
Feb 18, 2026