CVE-2025-70129

If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.

If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available.

Si la funcionalidad anti correo no deseado-captcha en las versiones 5.8.22 y anteriores de PluXml está habilitada, se genera un desafío captcha con un formato que puede ser reconocido automáticamente para los artículos, de tal manera que un script automatizado es capaz de resolver este mecanismo anti correo no deseado trivialmente y publicar comentarios de correo no deseado. Los detalles del desafío captcha están expuestos dentro del cuerpo del documento de los artículos con las funcionalidades de comentarios y anti correo no deseado-captcha habilitadas, incluyendo 'capcha-letter', 'capcha-word' y 'capcha-token' que pueden ser utilizados para construir una solicitud POST válida para publicar un comentario. Como tal, los atacantes pueden inundar los artículos con comentarios de correo no deseado automatizados, especialmente si no hay otras defensas web disponibles.