Vendors / Mojolicious Records 8 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 1
Exploited now Mojolicious records in CISA KEV No Mojolicious vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 57
Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00577 · Published 2025-05-03 · No fix listed CWE-338
Priority MEDIUM 53
The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
CVSS 3.1 MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00554 · Published 2024-04-07 · No fix listed CWE-400
Priority MEDIUM 47
Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.
CVSS 2.0 HIGH 10.0· Network · No auth · Interaction — · EPSS 0.02029 · Published 2011-05-03 · No fix listed CWE-20
Priority MEDIUM 47
Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.
CVSS 2.0 HIGH 10.0· Network · No auth · Interaction — · EPSS 0.02078 · Published 2011-05-03 · No fix listed CWE-20
Priority MEDIUM 46
Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.
CVSS 2.0 HIGH 10.0· Network · No auth · Interaction — · EPSS 0.01342 · Published 2011-05-03 · No fix listed
Priority LOW 36
Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00556 · Published 2025-05-03 · No fix listed CWE-321
Priority LOW 29
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
CVSS 2.0 MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.0388 · Published 2011-04-29 · No fix listed CWE-22
Priority LOW 23
Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS 2.0 MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01705 · Published 2011-05-03 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 1 4 0 0
THREATIST.IORead the docs