1 result · Clear filters · Feed
-
Medium 6.1
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected
Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes. HTML attributes inside of single quotes could be have code injected. For example, the variable "var" in <a …