CVE-2026-120638
2026-11-04
00h17 +00:00
00h17 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| Incorrect Behavior Order: Validate Before Canonicalize The product validates input before it is canonicalized. |
||
| URL Redirection to Untrusted Site The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
