CVE-2026-78190— WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting

Quick assessment

Affected

CVE-2026-78190

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 版本的 WebDyne 从 2.014 到 3.022（不含 3.022）存在跨站脚本（XSS）漏洞。该漏洞源于请求参数被未转义地反射到表单字段的值中。具体而言，、和标签会从同名请求参数中填充其属性。控制这些值转义的配置项默认处于关闭状态。此外，从 2.022 版本起，模块将其方法替换为一个直接返回原始输入的方法，导致即使启用也无效。远程攻击者可利用此漏洞，通过构造恶意链接，向任何使用上述标签的页面注入恶意脚本。

AI Predicted 6.1 Difficulty: Easy Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`2.014< 3.022`	affected

Updated Nov 01, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting

Source: CVE Program / CVE List V5

Vulnerability Description

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	2.014 ~ 3.022	-

II. Public POCs for CVE-2026-78190

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-78190

请登录查看更多情报信息。

Other References for CVE-2026-78190 (1)

https://metacpan.org/release/ASPEER/WebDyne-3.022/changes release-notes

https://www.cve.org/CVERecord?id=CVE-2026-78190

IV. Related Vulnerabilities

Same weakness: CWE-79