CVE-2026-121008mediumCWE-79

CVE-2026-121008: falha de média gravidade em SQL-Abstract

SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SQL-Abstract+ Monitorar perl-sql-abstract

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.2%
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
SQL-Abstract
CVEs relacionadas — SQL-Abstract

No mesmo produto, das mais perigosas para as menos.

CVE-2026-121265CRITICALSQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateEPSS 0.3%CVE-2026-121009HIGHSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -funcEPSS 0.2%CVE-2026-121007HIGHSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier positionEPSS 0.2%