Captcha is a system widely used in web forms to differentiate between humans and bots. I won't go into detail how it works but you can read it on Wikipedia. Many people try to defeat this system by writing very advanced character recognition software but there seems to be a very large hole in this system at the moment.

This vulnerability isn't on all of them, but about half the systems I tried, it works (Yahoo and Google to give two examples). It seems internally, when a new captcha image is generated, the corresponding plaintext is stored in a database. The problem is that this database just stores the plaintext without any connection to the client's identity (For example IP). So how can this bad?

Well you can refresh the captcha images in this system repeatedly and write down the plaintext values from the image. Now you can store those value's in a bot and have the bot enter those plaintext value's in.

Here are the steps for a proof-of-concept.

Go to Computer A, get a captcha image. Write down plaintext
Go to Computer B, go to same page, enter previous plaintext from different session