CVE-2026-121008mediumCWE-79

CVE-2026-121008: fallo de gravedad media en SQL-Abstract

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SQL-Abstract+ Monitorear perl-sql-abstract

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.2%
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
SQL-Abstract
CVEs relacionadas — SQL-Abstract

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-121265CRITICALSQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateEPSS 0.3%CVE-2026-121009HIGHSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -funcEPSS 0.2%CVE-2026-121007HIGHSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier positionEPSS 0.2%