CyberRota Analysis
AI-GeneratedApplications utilizing HTML::FormHandler versions prior to 0.410002 for Perl are vulnerable due to unescaped rendering of group and radio button labels, which can lead to injection of attacker-controlled content. This vulnerability allows for the potential manipulation of option lists and the embedding of malicious JavaScript in rendered pages, posing a significant risk to applications that dynamically generate option lists from user input or database sources. Developers and security teams managing Perl applications using this library should prioritize addressing this issue to mitigate the risk of cross-site scripting (XSS) attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages.