CVE-2025-40916
CRITICALMojolicious::Plugin::CaptchaPNG 1.05 - Info Disclosure
Title source: llmDescription
Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
References (4)
Scores
CVSS v3
9.1
EPSS
0.0028
EPSS Percentile
51.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-338
CWE-804
Status
published
Products (1)
GRYPHON/Mojolicious::Plugin::CaptchaPNG
1.05
Published
Jun 16, 2025
Tracked Since
Feb 18, 2026