CVE-2026-118991 CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digi...

EUVD-2026-113919

CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digi...

CVE-2026-118991

CallBackery versions prior to 0.62.0 are vulnerable to insecure encryption of configuration backups. The getCrypt() function generates an AES key by padding the backup password with "x" characters and truncating it to 32 bytes, without utilizing a salt or key derivation function. Because the firs...

CVE-2026-118992

Versions of CallBackery for Perl prior to 0.62.0 are vulnerable to OS command injection via a restored configuration backup. The root cause is that the restoreConfigBlob() function feeds a database dump from a backup into the sqlite3 command-line shell. Because the shell executes lines starting w...

CVE-2026-118992 CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or...

EUVD-2026-113918

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or...

EUVD-2026-113917

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

CVE-2026-118993

Versions of CallBackery for Perl before 0.62.0 are vulnerable to a Denial of Service (DoS) attack. The issue resides in the before_dispatch hook, which removes PATH_INFO from the request URI using a substitution that interpolates PATH_INFO unquoted. In CGI, FastCGI, and PSGI environments, an unau...

CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...

CVE-2026-118994 CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record...

EUVD-2026-113916

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record...

CVE-2026-118994

CallBackery versions prior to 0.62.0 for Perl are vulnerable to log injection due to improper output neutralization. The login() function writes the login name to the application log without escaping control characters. Because the login RPC method does not require authentication, an unauthentica...

CVE-2026-118995 CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...

EUVD-2026-113915

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator is documented to anchor the supplied pattern at both ends, but builds /^$rx$/ without grouping the pattern. An alternation such as yes|no then accepts any value...

CVE-2026-118995

CallBackery versions before 0.62.0 for Perl are vulnerable to a Permissive Regular Expression flaw (CWE-625) within the createRxValidator function. The vulnerability occurs because the function constructs the regex /^${rx}$/ without grouping the pattern; consequently, alternations like yes|no are...

CVE-2026-118996 CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

EUVD-2026-113914

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

CVE-2026-118996

Versions of CallBackery for Perl prior to 0.62.0 are vulnerable to information disclosure. The getUserConfig() function returns the entire cbuser row, including the stored password hash and an admin-only user note . Additionally, the getTableData() and getAllFieldValues() functions in the user ma...

CVE-2026-13576 CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmacsha1sum from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker w...

EUVD-2026-113913

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmacsha1sum from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker w...