CVE-2026-120637

— UNSCOREDpublic exploit available

Published 2026-11-04 · Updated 2026-11-04

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.

Weaknesses

CWE-489

Public exploit & PoC references

https://github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c075cc37c1db605a55297029.patch

All references

https://github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c075cc37c1db605a55297029.patch
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100102
MEDIUMCVE-2026-100295
CRITICALCVE-2026-102628
CRITICALCVE-2026-103475PoC
HIGHCVE-2026-115727PoC
UNSCOREDCVE-2026-13313
MEDIUMCVE-2026-15575
UNSCOREDCVE-2026-50228

Related by shared AI tags and CWE weakness class. Browse the full archive.