Search: “HTML::FormHandler”

4 items in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 0 high 0 medium 0 low 4 info 0

CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

CVE-2026-85630: HTML::FormHandler Perl versions before 0.410002 render field attributes into HTML unescaped, enabling HTML injection.

The Perl module HTML::FormHandler before version 0.410002 renders field attributes into HTML without escaping via the process_attrs method, per an oss-security disclosure. Applications using affected versions could allow unescaped markup to be injected into generated HTML. Users should upgrade to version 0.410002 or later.

oss-securitySep 8, 20:30 UTC · 7d agoVulnerability 2 sources CVE-2026-856301

CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders error messages into HTML unescaped, enabling cross-site scripting (CVE-2026-85485); fixed in 0.410002.

Robert Rothenberg disclosed CVE-2026-85485 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders some error messages into HTML without escaping, which can enable cross-site scripting in applications using its rendered output. The issue is fixed in version 0.410002.

oss-securitySep 8, 20:28 UTC · 7d agoVulnerability 2 sources CVE-2026-854851

CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

HTML::FormHandler before 0.410002 for Perl renders option group and radio button labels unescaped into HTML, enabling XSS (CVE-2026-85484).

Robert Rothenberg disclosed CVE-2026-85484 on the oss-security mailing list, affecting HTML::FormHandler versions before 0.410002 for Perl. The module renders option group labels and radio button labels into HTML without escaping, which can enable cross-site scripting in applications using the rendered markup. The issue is addressed in version 0.410002.

oss-securitySep 8, 20:16 UTC · 7d agoVulnerability 2 sources CVE-2026-85484

CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

Perl form library HTML::FormHandler before 0.410000 fixes CVE-2026-19872, a cross-site scripting flaw via unescaped submitted values in error messages.

CVE-2026-19872 was disclosed for the Perl HTML::FormHandler distribution: versions before 0.410000 render a submitted value unescaped within an error message, allowing cross-site scripting. The issue was announced by Robert Rothenberg on the oss-security mailing list. Applications using affected HTML::FormHandler versions should upgrade to 0.410000 or later.

oss-securitySep 8, 20:14 UTC · 7d agoVulnerability 2 sources CVE-2026-19872