CVE-2026-120636

The perl-cgi module (CGI versions before 5.00 for Perl) is vulnerable to open redirects and script injection due to insufficient validation of the client-supplied REQUEST_URI . Specifically, the url(-absolute=>1), url(-relative=>1), and the default start_form action are built directly from ...

CVE-2026-120636 CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url-absolute=1, url-relative=1 and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative...

CVE-2003-0615: Undefined Security Weakness

Cross-site scripting XSS vulnerability in startform of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter...