Vulnerability · Published Sep 15, 2025 · Assigned by VulDB
CVE-2025-10423newbee-mall kaptcha mallKaptcha Captcha
Low 3.7
In plain English
A low-severity improper authentication in newbee-mall. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | newbee-mall | 1.0 |
Weakness: CWE-804, CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-323857 | newbee-mall kaptcha mallKaptcha Captcha vdb-entry, technical-description
- VDB-323857 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #647066 | newbee-ltd newbee-mall V1.0 Guessable CAPTCHA third-party-advisory
- https://github.com/newbee-ltd/newbee-mall/issues/101 issue-tracking
- https://github.com/newbee-ltd/newbee-mall/issues/101#issue-3380163659 exploit, issue-tracking