EUVD-2026-74169
GHSA-m5h3-w9r6-p935
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible form submission requires no authentication; victim must view the rendered error page (UI:R); scope change (S:C) reflects XSS executing in browser context with limited C/I impact.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
4DescriptionCVE.org
HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping.
The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three.
Error messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.
AnalysisAI
Reflected XSS in HTML::FormHandler before 0.410002 allows unauthenticated network attackers to inject JavaScript into rendered Perl web application pages by submitting form input containing script content. The Table form layout and Bootstrap 2 and 3 wrappers interpolated error strings - including rejected field values - directly into HTML without HTML-entity encoding, an incomplete fix relative to CVE-2026-19872 (which patched equivalent paths in other layouts in version 0.410000). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target application uses HTML::FormHandler with the Table layout (HTML::FormHandler::Widget::Form::Table), the Bootstrap 2 wrapper (HTML::FormHandler::Widget::Wrapper::Bootstrap), or the Bootstrap 3 wrapper (HTML::FormHandler::Widget::Wrapper::Bootstrap3) - applications using other layouts fixed in 0.410000 are not affected; (2) the form's validation logic reflects attacker-controlled input (e.g., rejected field values) in the error messages rendered to the page, which is common but depends on field configuration; (3) the victim must view the rendered error page (CVSS UI:R), so the attacker must craft a scenario - such as a malicious link that pre-populates and submits the form - to trigger error display to the target user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is consistent with standard reflected XSS scoring. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade HTML::FormHandler to version 0.410002 or later via CPAN (cpan HTML::FormHandler or cpanm HTML::FormHandler). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today