critical · CVSS v3 9.1

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valu…

Description

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-121600

The vulnerability is a stack-based buffer overflow in the MAC Filter Handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104. It can be triggered remotely via the addEffect parameter in cstecgi.cgi, allowing attackers to crash the device or potentially execute arbitrary code.

View analysis

critical

CVE-2026-114549

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30685.

View analysis

critical

CVE-2026-120635

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

View analysis

critical

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

View analysis