CVE-2026-78190

    Dashboard / Vulnerabilities / CVE-2026-78190

    CVE-2026-78190

    Published: 31 Oct 2026Last Modified: 8 Nov 2026

    Summary: WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting

    Details: WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.

    References: https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78190.json, https://metacpan.org/release/ASPEER/WebDyne-3.022/changes, https://nvd.nist.gov/vuln/detail/CVE-2026-78190, https://github.com/aspeer/WebDyne

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- f34dace6205873d32395f8d6efa377880ecbf690
    Fixed -afb2fdc452ffda3a1bda1f63ef70b4ba52f083a9

    Affected versions

    v3.21.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-78190 | CVE-DB