Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

SQL::Abstract and SQL::Abstract::Tree before 2.000001_04 for Perl allow SQL injection and XSS (CVE-2026-121007,…

Original title: SQL-Abstract versions before 2.000001_04 for Perl (3 CVEs)

oss-security ()1
Read at seclists.org
Part of a story covered by 3 sourcesRothenberg discloses XSS and SQL injection flaws in Perl modulesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.

Robert Rothenberg posted that SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the...

Key facts
  • CVE-2026-121007
  • CVE-2026-121008
  • CVE-2026-121009
  • Affected: SQL::Abstract and SQL::Abstract::Tree
Analyze CVE-2026-121007 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-121007CVE-2026-121008CVE-2026-121009
Tags
sql-abstractsql-injectionxssperl
Vendors
Perl
Products
SQL::AbstractSQL::Abstract::Tree

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-121007
SQL injection in SQL::Abstract before 2.000001_04
7.3—
CVE-2026-121009
+1 related CVE
CVE-2026-121008
SQL Injection in SQL::Abstract before 2.000001_04
7.3
group max
—

From the original article

Posted by Robert Rothenberg on Nov 04 CVE-2026-121007 SQL::Abstract versions from 1. 90_01 before 2. 000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position CVE-2026-121008 SQL::Abstract::Tree versions before 2.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.