CVE-2026-120212
Beschrijving NL
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in <a href="$value">, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.
Origineel (Engels) tonen
Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.
HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", with entities. A value interpolated into a single-quoted attribute, as in <a href="$value">, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.
An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.