GCVE - cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Mojolicious (`5e0a3c34-0717-5884-830a-592d7c0fa999`)
Product	Mojolicious (`dc69d5ac-d68f-5b9d-8801-6db167222f7d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:cpan/mojolicious`	purl2cpe	2026-06-01 10:16:34.759747
`pkg:github/mojolicious/mojo`	purl2cpe	2026-06-01 10:16:34.759748

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-47208`	vulnerable	2026-06-08 05:38:06.684040	Details available The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. Published: 2024-04-07T00:00:00.000Z Updated: 2025-03-20T14:00:47.662Z Open on db.gcve.eu Reference links https://github.com/mojolicious/mojo/issues/1736 https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36829`	vulnerable	2026-06-08 05:25:49.619988	Details available The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected. Published: 2024-04-07T00:00:00.000Z Updated: 2025-03-13T20:37:14.708Z Open on db.gcve.eu Reference links https://github.com/mojolicious/mojo/pull/1601 https://github.com/mojolicious/mojo/issues/1599 https://lists.debian.org/debian-lts-announce/2024/06/msg00025.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-25100`	vulnerable	2026-06-08 05:11:29.367349	Details available The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar. Published: 2024-03-24T00:00:00.000Z Updated: 2025-04-10T20:08:35.089Z Open on db.gcve.eu Reference links https://github.com/mojolicious/mojo/pull/1192 https://github.com/mojolicious/mojo/issues/1185 https://github.com/mojolicious/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149 https://metacpan.org/dist/Mojolicious/changes	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1841`	vulnerable	2026-06-08 04:58:02.359726	Details available Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2011-05-03T00:03:00.000Z Updated: 2024-08-06T22:37:25.850Z Open on db.gcve.eu Reference links http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes https://exchange.xforce.ibmcloud.com/vulnerabilities/67257 http://www.securityfocus.com/bid/47713 http://www.debian.org/security/2011/dsa-2239 http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060122.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4803`	vulnerable	2026-06-08 04:56:31.078971	Details available Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors. Published: 2011-05-03T00:03:00.000Z Updated: 2024-08-07T04:02:29.557Z Open on db.gcve.eu Reference links http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.20/Changes http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952 http://www.debian.org/security/2011/dsa-2239	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4802`	vulnerable	2026-06-08 04:56:31.041325	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-5074`	vulnerable	2026-06-08 04:51:51.909975	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.