WebDyne versions from 2.014 before 3.022 for Perl contain a cross-site scripting (XSS) vulnerability. This occurs because request parameters are reflected unescaped into form field values, specifically in textfield, password_field, and filefield tags. The default setting WEBDYNE_CGI_AUTOESCAPE is off, allowing injection of scripts via crafted links. From version 3.022, changes to the entity_encode method render enabling auto-escaping ineffective.