The vulnerability is a reflected XSS flaw that occurs when WebDyne's form field tags populate their value attribute with request parameters that have not been escaped. This flaw is a CWE‑79 type input‑output validation error. An attacker can inject malicious JavaScript into any page by linking to it with crafted query string values. Once the script runs, it may steal session cookies, redirect users, or modify page content, compromising the confidentiality, integrity, and availability of data processed by the application.

The flaw affects the WebDyne Perl web framework versions from 2.014 up to but not including 3.022. Any installation that utilizes the textfield, password_field, or filefield tags without proper escaping is vulnerable. The vulnerability is present on any server running these versions without additional defensive coding.

The CVSS score is not specified and no EPSS score is available, and the flaw is not listed in CISA's KEV catalog. Despite the lack of public exploitation data, the attack requires only a crafted URL and no authentication, making it trivial for remote actors to target vulnerable sites. Because the flaw directly injects script into the browser, it presents a high severity XSS risk that can lead to session hijacking, defacement, or data theft. Organizations should treat this as a priority to remediate promptly.