CVE-2025-70129

If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70129.pdf	Exploit Third Party Advisory
https://youtu.be/dD2olE4yMqY	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:pluxml:pluxml:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 20:16

Updated : 2026-06-17 10:03

NVD link : CVE-2025-70129

Mitre link : CVE-2025-70129

CVE.ORG link : CVE-2025-70129

JSON object : View

Products Affected

pluxml

pluxml

CWE

CWE-804

Guessable CAPTCHA

{"id": "CVE-2025-70129", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70129", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:43:52.244393Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-10T20:16:20.540", "references": [{"url": "https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70129.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://youtu.be/dD2olE4yMqY", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including \"capcha-letter\", \"capcha-word\" and \"capcha-token\" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available."}, {"lang": "es", "value": "Si la funcionalidad anti correo no deseado-captcha en las versiones 5.8.22 y anteriores de PluXml est\u00e1 habilitada, se genera un desaf\u00edo captcha con un formato que puede ser reconocido autom\u00e1ticamente para los art\u00edculos, de tal manera que un script automatizado es capaz de resolver este mecanismo anti correo no deseado trivialmente y publicar comentarios de correo no deseado. Los detalles del desaf\u00edo captcha est\u00e1n expuestos dentro del cuerpo del documento de los art\u00edculos con las funcionalidades de comentarios y anti correo no deseado-captcha habilitadas, incluyendo 'capcha-letter', 'capcha-word' y 'capcha-token' que pueden ser utilizados para construir una solicitud POST v\u00e1lida para publicar un comentario. Como tal, los atacantes pueden inundar los art\u00edculos con comentarios de correo no deseado automatizados, especialmente si no hay otras defensas web disponibles."}], "lastModified": "2026-06-17T10:03:09.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pluxml:pluxml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F0CA1A2-CEEA-4454-B7EA-69887ADE63F0", "versionEndIncluding": "5.8.22"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}