Dashboard / CVE-2026-120638

CVE-2026-120638

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-11-04 Modified: 2026-11-09 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
— — 0 < 5.00
— — 0 < 5.00

References & Advisories (3)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.26%
Raw Score 0.002600
Percentile 17.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00260
2026-11-13
0.00260
2026-11-12
0.00260
2026-11-10
0.00260
2026-11-09
0.00181
2026-11-08
0.00181
2026-11-07
0.00181
2026-11-06
0.00181
2026-11-05
0.00181
2026-11-04
0.00181

Intelligence Sources

mitre ref →
nvd ref →

External Links