CVE-2026-121009

A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an...

CVE-2026-121008

A flaw was found in perl-sql-abstract. The SQL::Abstract::Tree component does not properly HTML-escape SQL text or bind values when generating output using the HTML profile. If an application displays this formatted SQL in a web interface, such as a debug panel or query log, an attacker who...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...

CVE-2026-121009

The SQL::Abstract Perl module (versions 1.90_01 through 2.000001_03 ) contains a vulnerability where the injection_guard check is bypassed when providing function names via the explicit { -func => [ $name, ... ] } form. While the { -name => ... } shorthand correctly triggers the guard, the ...

EUVD-2026-116929

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

CVE-2026-121008

The SQL::Abstract::Tree module for Perl (versions before 2.000001_04 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is that the format method fails to HTML-escape SQL text or bind values when using the html profile , which is designed to output markup for web pages. This allows an...

EUVD-2026-116928

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

CVE-2026-121007

The SQL::Abstract Perl module (versions 1.90_01 to 2.000001_04 ) is vulnerable to SQL injection . The root cause is that nested statements (e.g., { -select => ... }) placed in positions where plain scalars are treated as identifiers—such as the select list , ORDER BY , GROUP BY , RETURNING , a...

EUVD-2026-116927

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

CVE-2026-121009: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

PT-2026-136981

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl skip the injection guard check for function names given with -func. injection guard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name in...

PT-2026-136980

SQL::Abstract::Tree versions before 2.000001 04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

CVE-2026-121008: Cross-site Scripting (XSS)

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

CVE-2026-121007: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

PT-2026-136979

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. The...

CVE-2026-13766

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quotechar, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers orderby, where-claus...

PT-2026-53847

Name of the Vulnerable Software and Affected Versions DBIx::QuickORM versions prior to 0.000026 Description An issue exists where SQL identifiers are emitted verbatim into generated queries without proper quoting or escaping. This occurs because the default SQL builder, a SQL::Abstract subclass,...

CVE-2026-13766: Improper Neutralization of Special Elements used in an SQL Command

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quotechar, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers orderby, where-claus...