CVE-2026-120212

Not scored yetLast modified Nov 12, 2026

Description

Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.

HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.

An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
——< 0.037

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1202139.1@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 througCVE-2026-1202145.9@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 throuCVE-2026-1202153.7@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin wCVE-2026-1202165.9fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a CVE-2026-1202174.3A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py oCVE-2026-1202183.5A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemiCVE-2026-120228.3Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to CVE-2026-1202218.2In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen CVE-2026-1202225.9undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cache interceptor is composed withCVE-2026-1202233.1A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the cCVE-2026-1202249.9A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the cCVE-2026-1202259.1A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of th
CVE-2026-120212: Unscored | Vulnix