CGI versions from 4.62 up to but not including 5.00 for Perl contain a cross-site scripting (XSS) vulnerability. This occurs because URLs returned by the url and self_url methods pass through URI's canonical method, which leaves apostrophes in the path raw and decodes %27 in query parameters. If an application inserts these URLs into single-quoted HTML attributes or JavaScript strings, it may be vulnerable to XSS attacks.
CGI versions prior to 5.00 for Perl contain a denial of service vulnerability. This occurs when submitted values are used as regular expressions for optgroup selection in the scrolling_list function without proper escaping. Malicious input can cause the process to crash or become unresponsive due to heavy regex backtracking.
A critical stack-based buffer overflow vulnerability exists in the Easy Setup Wizard Handler component of TOTOLINK A950RG firmware version 4.1.2cu.5268_B20221104. The flaw is triggered by manipulating the functionType argument in the setAppEasyWizardConfig function via the /cgi-bin/cstecgi.cgi endpoint. This vulnerability can be exploited remotely and has publicly available exploit code.
CVE-2026-92191 is a high-severity vulnerability in Quest Foglight for Databases affecting the runScript function. It allows remote authenticated attackers to execute arbitrary code with SYSTEM privileges due to incorrect authorization checks. This flaw requires authentication but does not require user interaction. No patch information is currently available.
CGI versions before 5.00 for Perl contain a vulnerability where the Content-Disposition header's attachment filename parameter is susceptible to injection via unescaped double quotes. This allows an attacker to inject a second filename parameter by manipulating the attachment name, potentially altering the filename under which the response is saved.
CGI versions before 5.00 for Perl have a vulnerability that allows memory, CPU, and disk exhaustion due to missing or unenforced limits on request size, parameters, and uploads. The default setting for $CGI::POST_MAX imposes no limit, and even when set, it is not enforced for certain multipart request bodies. This can lead to resource exhaustion as request bodies are read fully into memory without restrictions.
CVE-2026-92190 is a critical remote code execution vulnerability in Quest Foglight for Databases. It arises from insecure deserialization in the baseRmiServiceExporter bean, allowing unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges. The flaw is due to improper validation of user-supplied data before deserialization.
CGI versions for Perl prior to 5.00 return uploaded filenames including any client-supplied path segments, such as ../ or Windows-style paths. This means the filename is taken directly from the Content-Disposition header without sanitization. Applications that save uploaded files using this name risk writing files outside the intended directory.
CVE-2026-92192 is a directory traversal vulnerability in the installLicense script of Quest Foglight for Databases. It allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied paths in file operations. The vulnerability has a high severity with a CVSS score of 8.8.
CGI versions before 5.00 for Perl contain an open redirect vulnerability due to HTML entity decoding of URLs after application validation. This allows an attacker to craft URLs that bypass validation and redirect users to arbitrary external sites.
CVE-2026-92186 is a directory traversal vulnerability in Quest Foglight for Databases affecting the paFnUploadFileAndCreateInfo script. It allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges by exploiting improper validation of user-supplied file paths.
CGI versions for Perl prior to 5.00 improperly handle unrecognized REQUEST_METHOD values by taking request parameters from the process command line arguments. Specifically, for methods like OPTIONS, CGI defaults to an offline debugging mode that is enabled by default and constructs parameters and path_info from the command line arguments.
CGI versions before 5.00 for Perl allow certain parameters (POSTDATA, PUTDATA, PATCHDATA, and XForms:Model) to be set from query strings or form fields, which can confuse application logic that expects these parameters to represent the actual request body. This can enable cross-site request forgery (CSRF) attacks where a malicious HTML form posts crafted data to an endpoint that reads JSON from these parameters without requiring CORS preflight.
A Server-Side Request Forgery (SSRF) vulnerability in the get-artifacts function of MLflow allows remote attackers to disclose sensitive information without authentication. The flaw arises from improper validation of URIs before resource access, enabling information disclosure in the server context. The vulnerability has a high severity with a CVSS score of 8.2.
CGI::Cookie versions from 4.67 up to but not including 5.00 for Perl contain a denial of service vulnerability. The flaw arises because the expires value from client cookies is used unescaped as a regular expression pattern in the parse method, allowing crafted input to cause process crashes or excessive backtracking.
CGI versions before 5.00 for Perl trust the client-supplied X-Forwarded-Host header when constructing URLs such as url, self_url, virtual_host, and virtual_port. This header is used without validation, allowing an attacker to influence redirect locations, base hrefs, and form actions. This can lead to cache poisoning and the generation of URLs that point to attacker-controlled hosts.
CGI::Carp versions before 5.00 for Perl have a vulnerability where warnings are leaked across requests in persistent environments such as mod_perl, FastCGI, or PSGI. This occurs because warnings are stored in a package-level buffer that is not cleared between requests, causing warnings from one user's request to appear in the HTML output of another user's request as HTML comments.
A deserialization vulnerability in MLflow's SHAP load_explainer function allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. This flaw arises from improper validation of user-supplied data during the loading of SHAP explainer models, enabling code execution in the context of the current user.
CGI versions before 5.00 for Perl contain a vulnerability in their multipart/form-data parser that allows form fields to be smuggled past proxies and web application firewalls (WAFs). This occurs because the parser matches boundaries incorrectly, uses boundaries without the leading '--' for certain User-Agent values, misinterprets Content-Disposition parameters, and corrupts parts near the 4096-byte read size.
CGI versions before 5.00 for Perl contain a vulnerability where a specially crafted POST request with a multipart/related Content-Type can cause CPU exhaustion. This occurs due to a backtracking regular expression used to extract boundary and start parameters, which can lead to cubic time complexity on certain headers without requiring a request body.