CGI versions before 5.00 for Perl contain vulnerabilities that allow open redirects and script injection via URLs constructed from the client-supplied REQUEST_URI in url and start_form functions. These URLs are built without validation and can lead to protocol-relative, absolute, or javascript: URLs, enabling redirection or injection attacks.