CVE-2025-70129 Security feature bypass in n/a
Attackers can bypass anti-spam captcha by extracting challenge details from page source to flood articles with automated spam comments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-70129?
CVE-2025-70129 is a medium-severity vulnerability in n/a, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.
Weakness: CWE-804
Which versions are affected by CVE-2025-70129?
It affects 1 product.
Products include Pluxml Pluxml.
How do I fix CVE-2025-70129?
No fix has been published for CVE-2025-70129 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-70129 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70129 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-4639-47cp-327m, UBUNTU-CVE-2025-70129.