CVE-2026-78190
Received Received - Intake

Cross-Site Scripting in WebDyne Perl Application

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: CPANSec

Description
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-78190
EUVD
EUVD-2026-114716

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
webdyne webdyne From 2.014|end_excluding=3.022 (inc)
webdyne webdyne From 2.014 (inc) to 3.022 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in WebDyne versions from 2.014 before 3.022 for Perl. It occurs because request parameters are reflected unescaped into form field values, allowing attackers to inject malicious scripts via crafted links.

Detection Guidance

Check WebDyne versions with: grep -r "WebDyne" /path/to/installation or version checks in admin panels. Look for reflected parameters in forms using tags like textfield, password_field, or filefield. Test with crafted links containing script payloads to see if values are reflected unescaped.

Impact Analysis

An attacker could exploit this to inject and execute arbitrary scripts in a user's browser when they visit a vulnerable page. This could lead to session hijacking, defacement, or theft of sensitive data like cookies or form inputs.

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data or enabling unauthorized access to personal information. For HIPAA, it may compromise protected health information if exploited on healthcare-related systems.

Mitigation Strategies

Upgrade WebDyne to version 3.022 or later. Enable WEBDYNE_CGI_AUTOESCAPE if using versions before 2.022. For versions 2.022+, upgrade to WebDyne::HTML::Tiny with proper escaping. Sanitize all user inputs and avoid using vulnerable tags in forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart