CyberRota Analysis
AI-GeneratedApplications utilizing HTML::FormHandler versions prior to 0.410002 for Perl are vulnerable due to improper escaping of field attributes, allowing attackers to inject malicious JavaScript or override field attributes through user-controlled data. This vulnerability poses a significant risk to web applications that dynamically generate HTML content based on user input. Developers and security teams managing applications with this library should prioritize remediation to prevent potential cross-site scripting (XSS) attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods.