PULSEUnderground Intel

EN VIVO22señales / 24h

FEED

ransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransombooba project reclama a Chicago Vein Institute · US · Healthcareransombooba project reclama a Pearland Pediatrics · US · Healthcareransombooba project reclama a City of Mt. Angel, Oregon · US · Government & Defenseransombooba project reclama a City Hall - Everett, MA · US · Government & Defenseransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransombooba project reclama a Chicago Vein Institute · US · Healthcareransombooba project reclama a Pearland Pediatrics · US · Healthcareransombooba project reclama a City of Mt. Angel, Oregon · US · Government & Defenseransombooba project reclama a City Hall - Everett, MA · US · Government & Defense

← Todos los CVEs

CVE Watch20 oct 2026

CVE-2026-112067

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image c

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 20 oct 2026 · Última mod.: 20 oct 2026 · CWE-656 · CWE-804

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.

Referencias oficiales

typo3.orghttps://typo3.org/security/advisory/typo3-ext-sa-2026-030

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1112785.3 MED

——7NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.4d CVE-2024-235674.3 MED

——7HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.19d CVE-2024-235666.5 MED

——5HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration19d CVE-2026-130825.3 MED

——7GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.95d CVE-2025-104233.7 BAJ

——11A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.1d CVE-2025-508508.6 ALT

——4An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks.108d