https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 20:12:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-121632 <p>Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.</p> <p>process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option&#39;s value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.</p> <p>Any application whose option list is built from data rather than literals, using an options_&lt;field_name&gt; method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.</p> <p>Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.</p> <p>process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option&#39;s value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.</p> <p>Any application whose option list is built from data rather than literals, using an options_&lt;field_name&gt; method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.</p> https://db.gcve.eu/vuln/fkie_cve-2026-121632 https://db.gcve.eu/vuln/ghsa-7pvx-4mx6-w9xm <p>Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.</p> <p>process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option&#39;s value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.</p> <p>Any application whose option list is built from data rather than literals, using an options_&lt;field_name&gt; method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.</p> <p>Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping.</p> <p>process_attrs writes each attribute value into the markup as is. The select, radio group and checkbox group renderers pass each option to it, so an option&#39;s value becomes an unescaped attribute. Option and option group labels are also unescaped, the group label inside a label attribute and the others in element content.</p> <p>Any application whose option list is built from data rather than literals, using an options_&lt;field_name&gt; method, a build_options method or a DBIC model, allows attacker-influenced text in an option value or label that can embed JavaScript in rendered pages. Attribute values built from data, such as through element_attr, are affected the same way.</p> https://db.gcve.eu/vuln/ghsa-7pvx-4mx6-w9xm