CVE-2026-125729

— UNSCOREDpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header. Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block.

Weaknesses

CWE-684

Public exploit & PoC references

https://github.com/pangyre/Plack-Middleware-CSP/issues/1

All references

https://github.com/pangyre/Plack-Middleware-CSP/issues/1
https://metacpan.org/release/ASHLEY/Plack-Middleware-CSP-0.03/source/CHANGES
http://www.openwall.com/lists/oss-security/2026/11/10/16

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-106361
MEDIUMCVE-2026-106390
UNSCOREDCVE-2026-119078

Related by shared AI tags and CWE weakness class. Browse the full archive.