CVE-2026-120212: fallo en Web-Simple
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
0Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Track
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Productos afectados
Web-SimpleCVEs relacionadas — Web-Simple
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-114629HIGHWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parametersEPSS 0.5%CVE-2026-114627MEDIUMWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputEPSS 0.2%