CVE-2026-5090
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
19/05/2026
Última modificación:
20/05/2026
Descripción
*** Pendiente de traducción *** Template::Plugin::HTML versions through 3.102 for Perl allows HTML and JavaScript to be injected.<br />
<br />
The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in<br />
<br />
<br />
<br />
would not be properly escaped. An attacker could insert some limited HTML and JavaScript, for example,<br />
<br />
var = " &#39; onclick=&#39;while (true) { alert(1) }&#39;"<br />
<br />
Note that arbitrary HTML and JavaScript would be difficult to inject, because angle brackets, ampersands and double-quotes would still be escaped.
Impacto
Puntuación base 3.x
6.10
Gravedad 3.x
MEDIA