Fedora 45 : perl-HTML-FormHandler (2026-406a152d49)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-406a152d49 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

Fedora 44 : perl-HTML-FormHandler (2026-21850d7df0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-21850d7df0 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

Fedora 43 : perl-HTML-FormHandler (2026-167a356523)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-167a356523 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

[SECURITY] Fedora 43 Update: perl-HTML-FormHandler-0.410002-1.fc43

HTML::FormHandler is a form handling class that validates HTML form data and, for database forms, saves it to the database on validation. It has field classes that can be used for creating a set of widgets and highly automatic templates. There are two simple rendering roles plus a set of widget...

[SECURITY] Fedora 44 Update: perl-HTML-FormHandler-0.410002-1.fc44

HTML::FormHandler is a form handling class that validates HTML form data and, for database forms, saves it to the database on validation. It has field classes that can be used for creating a set of widgets and highly automatic templates. There are two simple rendering roles plus a set of widget...

[SECURITY] Fedora 45 Update: perl-HTML-FormHandler-0.410002-1.fc45

HTML::FormHandler is a form handling class that validates HTML form data and, for database forms, saves it to the database on validation. It has field classes that can be used for creating a set of widgets and highly automatic templates. There are two simple rendering roles plus a set of widget...

CVE-2026-85484

A flaw was found in HTML::FormHandler for Perl. This vulnerability allows a remote attacker to inject malicious script into web pages. The component fails to properly escape option group labels and radio button labels when rendering them into HTML. This can lead to Cross-Site Scripting XSS attack...

CVE-2026-85485

A flaw was found in HTML::FormHandler for Perl. This vulnerability allows a remote attacker to inject malicious script code into web pages. The component fails to properly escape certain error messages when rendered into HTML. This can lead to a Cross-Site Scripting XSS vulnerability, enabling an...

CVE-2026-19872

A flaw was found in HTML::FormHandler. A remote attacker could exploit this vulnerability by submitting malicious input that is then rendered unescaped in error messages. This allows the attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosu...

perl-HTML-FormHandler-0.410.2-1.1 on GA media (moderate)

perl-HTML-FormHandler-0.410.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11745-1 Rating: moderate Cross-References: CVE-2022-4993 CVE-2026-19872 CVE-2026-85484 CVE-2026-85485 CVE-2026-85630 Affected Products: openSUSE Tumbleweed An update that solves 5 vulnerabilities can now be installed...

OPENSUSE-SU-2026:11745-1 perl-HTML-FormHandler-0.410.2-1.1 on GA media

These are all security issues fixed in the perl-HTML-FormHandler-0.410.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-85630

A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...

CVE-2026-85630

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

DEBIAN-CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

DEBIAN-CVE-2026-85630

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

DEBIAN-CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

CVE-2026-85630

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...