CVE-2025-40916

CVE-2025-40916: Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha text

Vendor Gryphon

Product Mojolicious::Plugin::CaptchaPNG

Weakness CWE-338

Published June 16, 2025

Last update June 16, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha. That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.

Key dates

02Disclosure timeline

June 16, 2025 CVE published

June 16, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-40916 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/338.html

Related vulnerabilities

04Related CVE

CVE-2026-40514 SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG CVE-2025-22376 CVE-2024-57854 Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator CVE-2024-56370 Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions CVE-2025-3495 COMMGR - Insufficient Randomization Authentication Bypass