2 lines
1.7 KiB
JSON
2 lines
1.7 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","modules":["Web::Simple"],"packageName":"Web-Simple","packageURL":"pkg:cpan/Web-Simple","programFiles":["lib/XML/Tags.pm"],"programRoutines":[{"name":"XML::Tags::to_xml_string"}],"repo":"https://github.com/p5sagit/Web-Simple","versions":[{"lessThan":"0.037","status":"affected","version":"0","versionType":"custom"}]}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page."}],"id":"CVE-2026-120212","lastModified":"2026-11-10T18:17:19.447","metrics":{},"published":"2026-11-10T18:17:19.447","references":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://metacpan.org/release/ETHER/Web-Simple-0.037/changes"},{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","url":"https://www.cve.org/CVERecord?id=CVE-2026-5090"}],"sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary"}]}
|