# CWE-804.

Every Advisory and CVE whose sources give the weakness CWE-804, newest first.

## Records, newest first

- [TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)](https://agentprime.io/advisories/PKSA-rwzb-f3sr-qs44.md)
  `PKSA-rwzb-f3sr-qs44`, `CVE-2026-112067` · Packagist `blueways/bw-captcha`: affected `>=4.0.0, <5.4.2`, fixed in `5.4.2` · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-656, CWE-804
- [NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML](https://agentprime.io/advisories/CVE-2026-111278.md)
  `CVE-2026-111278` · CVE record: nivocart nivocart · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-804
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have…](https://agentprime.io/advisories/CVE-2024-23566.md)
  `CVE-2024-23566` · CVE record: HCLSoftware Aftermarket EPC · CVSS 6.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-804
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which…](https://agentprime.io/advisories/CVE-2024-23567.md)
  `CVE-2024-23567` · CVE record: HCLSoftware Aftermarket EPC · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-804
- [GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets](https://agentprime.io/advisories/CVE-2026-13082.md)
  `CVE-2026-13082` · CVE record: BURAK GD::SecurityImage · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Weak cryptography or TLS, CWE-804
- [Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set](https://agentprime.io/advisories/CVE-2026-49953.md)
  `CVE-2026-49953` · CVE record: Discuz! Discuz! X5.0 · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-804
- [CAPTCHA Bypass in WWBN/AVideo via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure](https://agentprime.io/advisories/GHSA-hg7g-56h5-5pqr.md)
  `GHSA-hg7g-56h5-5pqr`, `CVE-2026-40935`, `PKSA-k6wt-ck7m-8514` · Packagist `wwbn/avideo`: affected `<=29.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-804
- [If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an…](https://agentprime.io/advisories/CVE-2025-70129.md)
  `CVE-2025-70129` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-804
- [WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-27411.md)
  `CVE-2026-27411` · CVE record: jp-secure SiteGuard WP Plugin · CVSS 5.4 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-804
- [newbee-mall kaptcha mallKaptcha Captcha](https://agentprime.io/advisories/CVE-2025-10423.md)
  `CVE-2025-10423` · CVE record: newbee-mall · CVSS 6.3 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Authentication bypass, CWE-804
- [atjiu pybbs Verification Code login Captcha](https://agentprime.io/advisories/CVE-2025-8546.md)
  `CVE-2025-8546` · CVE record: atjiu pybbs · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Authentication bypass, CWE-804
- [An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting.](https://agentprime.io/advisories/CVE-2025-50850.md)
  `CVE-2025-50850` · CVE record · CVSS 8.6 High · Not analysed yet · Published 31 Jul 2025 · Tags: Broken access control, CWE-804
- [Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text](https://agentprime.io/advisories/CVE-2025-40916.md)
  `CVE-2025-40916` · CVE record: GRYPHON Mojolicious::Plugin::CaptchaPNG · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2025 · Tags: Weak cryptography or TLS, CWE-804
- [DNN allows the possibility of bypassing Captcha](https://agentprime.io/advisories/CVE-2025-32036.md)
  `CVE-2025-32036` · CVE record: dnnsoftware Dnn.Platform · CVSS 4.2 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-804
- [Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass](https://agentprime.io/advisories/CVE-2025-1262.md)
  `CVE-2025-1262` · CVE record: webfactory Advanced Google reCAPTCHA · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-804
- [WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability](https://agentprime.io/advisories/CVE-2024-30540.md)
  `CVE-2024-30540` · CVE record: Guido VS Contact Form · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-804
- [WordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerability](https://agentprime.io/advisories/CVE-2024-31295.md)
  `CVE-2024-31295` · CVE record: BestWebSoft Captcha by BestWebSoft · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2024 · Tags: CWE-804
- [Getwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass](https://agentprime.io/advisories/CVE-2023-6963.md)
  `CVE-2023-6963` · CVE record: jetmonsters Getwid – Gutenberg Blocks · CVSS 5.3 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: CWE-804
- [Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypass](https://agentprime.io/advisories/CVE-2022-4036.md)
  `CVE-2022-4036` · CVE record: codepeople Appointment Hour Booking – Booking Calendar · CVSS 5.3 Medium · Not analysed yet · Published 29 Nov 2022 · Tags: CWE-804
- [Very Simple Contact Form < 11.6 - Captcha bypass](https://agentprime.io/advisories/CVE-2022-1801.md)
  `CVE-2022-1801` · CVE record: Unknown Very Simple Contact Form · No CVSS score · Not analysed yet · Published 20 Jun 2022 · Tags: CWE-804

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-804>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-804/>. Everything for agents: <https://agentprime.io/llms.txt>.