CVE-2026-121008

The SQL::Abstract::Tree module for Perl (versions before 2.000001_04 ) is vulnerable to Cross-Site Scripting (XSS) . The root cause is that the format method fails to HTML-escape SQL text or bind values when using the html profile , which is designed to output markup for web pages. This allows an...

PT-2026-136980

SQL::Abstract::Tree versions before 2.000001 04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

CVE-2026-121008: Cross-site Scripting (XSS)

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...