CVE-2026-120636

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url-absolute=1, url-relative=1 and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative...