Mojolicious
6 CVEs across 1 Mojolicious products. Browse Mojolicious vulnerabilities, severities, and proof-of-concept exploits.
Mojolicious products with known CVEs
Mojolicious CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2024-58134 | High | 8.1 | 2025-05-03 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.
These pred… |
CVE-2024-58135 | Medium | 5.3 | 2025-05-03 | Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default.
When creating a defaul… |
CVE-2021-47208 | Medium | 4.3 | 2024-04-08 | The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. |
CVE-2011-1841 | | | 2011-05-03 | Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2010-4803 | | | 2011-05-03 | Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors. |
CVE-2010-4802 | | | 2011-05-03 | Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors. |
CVE-2009-5074 | | | 2011-05-03 | Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors. |
CVE-2011-1589 | | | 2011-04-29 | Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot s… |