CVE-2025-70129

{"id": "CVE-2025-70129", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-10T20:16:20.540", "references": [{"url": "https://github.com/forest4x/vuln-research-public/blob/main/CVE-2025-70129.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://youtu.be/dD2olE4yMqY", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including \"capcha-letter\", \"capcha-word\" and \"capcha-token\" which can be used to construct a valid post request to publish a comment. As such, attackers can flood articles with automated spam comments, especially if there are no other web defenses available."}, {"lang": "es", "value": "Si la funcionalidad anti correo no deseado-captcha en las versiones 5.8.22 y anteriores de PluXml est\u00e1 habilitada, se genera un desaf\u00edo captcha con un formato que puede ser reconocido autom\u00e1ticamente para los art\u00edculos, de tal manera que un script automatizado es capaz de resolver este mecanismo anti correo no deseado trivialmente y publicar comentarios de correo no deseado. Los detalles del desaf\u00edo captcha est\u00e1n expuestos dentro del cuerpo del documento de los art\u00edculos con las funcionalidades de comentarios y anti correo no deseado-captcha habilitadas, incluyendo 'capcha-letter', 'capcha-word' y 'capcha-token' que pueden ser utilizados para construir una solicitud POST v\u00e1lida para publicar un comentario. Como tal, los atacantes pueden inundar los art\u00edculos con comentarios de correo no deseado automatizados, especialmente si no hay otras defensas web disponibles."}], "lastModified": "2026-04-07T01:21:14.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pluxml:pluxml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F0CA1A2-CEEA-4454-B7EA-69887ADE63F0", "versionEndIncluding": "5.8.22"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}