CVE-2026-120212: falha em Web-Simple
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
0Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Track
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Produtos afetados
Web-SimpleCVEs relacionadas — Web-Simple
No mesmo produto, das mais perigosas para as menos.
CVE-2026-114629HIGHWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parametersEPSS 0.5%CVE-2026-114627MEDIUMWeb::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputEPSS 0.2%