UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-120648
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be made to inject HTML into the page.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-04T01:29:06.847378+00:00
- Cve id
- CVE-2026-120648
- First seen by Signal
- 2026-11-04T01:30:00+00:00
- Name
- CVE-2026-120648
- Retrieved at
- 2026-11-04T01:30:00+00:00
- Published at
- 2026-11-04T00:17:26.377
- Last modified
- 2026-11-04T00:17:26.377
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph