19103 matches found
CVE-2026-13051
Form::Processor::Field::HtmlArea for Perl (versions 0.06–1.162360) is vulnerable. An HTML::Tidy diagnostic passed to add_error as a Locale::Maketext template enables attacker-controlled method dispatch and possible resource exhaustion, causing unhandled exceptions or memory allocation issues. The...
CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-13048
Data::MuForm::Localizer for Perl (through v0.05) is vulnerable. load_lexicon constructs catalog paths using Messages/$lang.po without validating bare locale tags, enabling ../ path traversal and loading of arbitrary .po files. While parsing, the code evaluates header-derived content (Plural-Forms...
EUVD-2026-58117
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
CVE-2022-4993
CVE-2022-4993 affects HTML::FormHandler versions through 0.40068 for Perl. The vulnerability arises because _apply_actions and add_error construct error messages using request data as a Locale::Maketext template. This allows an attacker to trigger method dispatch on the language handle, enabling ...
CVE-2022-4993
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
EUVD-2022-56018
HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template
HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...
CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
DEBIAN-CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
AZL-95756 CVE-2026-19487 affecting package perl for versions less than 5.38.2-516
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
UBUNTU-CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-19487
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...