Re:Lycos is still around and its search is pretty good
by post_below on Saturday February 08, 2020 @12:26AM
(#22274107)
CGI as in "Common Gateway Interface" or CGI.pm?
If the former, the injection vulnerability would be in the script talking to the server/database via CGI, rather than in CGI itself.
If the latter I don't remember any major unpatched vulnerabilities in CGI.pm, but it was epically inefficient.
(perl's OK, CGI had a lot more server side injection risk from what I remember)