CVE-2026-78192 WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root...

CVE-2026-78192

WebDyne versions 2.022 before 3.022 for Perl are vulnerable to an information disclosure flaw. The application's wrapper scripts (e.g., webdyne.psgi ) enable a built-in index page by default, which includes a source viewer. This viewer returns files from the document root—including .psp , .pm , a...

EUVD-2026-114718

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root...

CVE-2026-78191

The WebDyne software (versions 2.031 to before 3.022) is vulnerable to remote code execution because it incorrectly identifies files containing .psp anywhere in the name as Perl pages. This issue stems from the WEBDYNE_PSP_EXT_RE regular expression lacking an end anchor. An attacker can exploit t...

EUVD-2026-114717

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNEPSPEXTRE, which has no end anchor. An application that accepts uploads by checking only the...

CVE-2026-78190

The WebDyne software (versions 2.014 before 3.022 for Perl) is vulnerable to cross-site scripting (XSS) because request parameters are reflected into form field values without proper escaping. Specifically, the textfield, password_field, and filefield tags populate their value attributes from req...

EUVD-2026-114716

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, passwordfield and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNECGIAUTOESCAPE, which control...

CVE-2026-78189

WebDyne versions from 3.007 before 3.022 are vulnerable to a path traversal vulnerability in the PSGI API route fallback . When a request matches no file, the PSGI handler retries it as an API route via api_filename, which preserves .. segments in the request path. Because the system only verifie...

EUVD-2026-114715

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78188

The WebDyne Perl module (versions 2.014 before 3.022 ) is vulnerable due to WebDyne::Session generating session cookies that lack the Secure , HttpOnly , and SameSite attributes. Because the cookies are only configured with a name, value, and path, browsers may transmit session IDs over plain HTT...

EUVD-2026-114714

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to...

CVE-2026-78188: WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite…

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to...

CVE-2026-78190: WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing…

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, passwordfield and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNECGIAUTOESCAPE, which control...

CVE-2026-78191: WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNEPSPEXTRE, which has no end anchor. An application that accepts uploads by checking only the...

CVE-2026-78189: WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in…

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78192: WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer…

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root...

CVE-2026-5084

WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the referen...

CVE-2026-5084

WebDyne::Session versions before 3.003704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the...

CVE-2026-5084 WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely

WebDyne::Session versions before 3.003704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the...

EUVD-2026-29039

WebDyne::Session versions through 2.075 for Perl generates the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the referen...