CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.
Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early.
An application that passes request data to comment can be made to inject HTML into the page.
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub