{"id":"CVE-2026-120212","published":"2026-11-10T18:17:19.447","lastModified":"2026-11-10T18:17:19.447","description":"Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output.\n\nHTML::Tags and XML::Tags escape a plain string value by replacing only &, \", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected.\n\nAn attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch","tags":[]},{"url":"https://metacpan.org/release/ETHER/Web-Simple-0.037/changes","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5090","tags":[]}],"exploitRefs":[{"url":"https://github.com/p5sagit/Web-Simple/commit/de0b7743f7015ec2c1c678dfdaa4bc6f5ccfb640.patch","tags":[]}],"hasPoc":true,"ai":null}