PT-2026-134512
CVE-2026-78190
·
Published
2026-10-31
·
Updated
2026-10-31
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting.
The textfield, password field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE CGI AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity encode method with one that returns its input unchanged, so enabling WEBDYNE CGI AUTOESCAPE has no effect.
A remote attacker can inject script into any page using these tags through a crafted link.
Found an issue in the description? Have something to add? Feel free to write us 👾