by Kastro
Paper/Archive/CVE-2025-40916

CVE-2025-40916

GRYPHON Mojolicious::Plugin::CaptchaPNG — Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.4.364 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.

Affected

ProductAffectedFixed inSource
Mojolicious::Plugin::CaptchaPNG1.05–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refmetacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.04/diff/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.05/lib/Mojolicious/Plugin/CaptchaPNG.pmrefmetacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.06/changesrefmetacpan.org/pod/perlfunc#randrefsecurity.metacpan.org/docs/guides/random-data-for-security.html