216 matches found
CVE-2020-8165
CVE-2020-8165 Ruby on Rails For educational purposes only. See Reference for the details. Environment Ruby: 2.6.3 Rails: 5.2.3 Run $ git clone https://github.com/masahiro331/CVE-2020-8165.git $ bundle install --path vendor/bundle $ bundle exec rails db:migrate $ bundle exec rails s use redis $...
Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution
Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution Script that exploits the vulnerability that allows remote code execution in Ruby 2.3.8 with CVE-2016-2098 Usage ./RubyOnRailsActionPackInlineERB-RemoteCodeExecution.py -h --target-host TARGETHOST --port PORT --target-uri TARGETURI...
cve-2019-5420-POC
Rails ActiveSupport Exploit cve-2019-5420 POC consider this to chain CVE-2019-5418! Pairs lovely with CVE-2019-5418! POC Screenshot 🚨 Warning This repository contains a proof-of-concept PoC exploit demonstrating remote code execution RCE in Ruby on Rails applications via...
EUVD-2026-122994
Action View: Possible XSS vulnerability in striptags...
GHSA-RQ8Q-P985-FJQ7 Action View: Possible XSS vulnerability in strip_tags
Impact striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded. Because ERB does not escape a string marked htmlsafe, untrusted input passed through striptags and rendered inside a quoted HTML attribute value...
rails-PoC-CVE-2016-2098
A Proof of Concept of vulnerability: CVE-2016-2098 University project created by @alejandro-marting where we can check the vulnerability 2096 Using: rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb !...
CVE-2026-126075
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no...
CVE-2026-126070
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
UBUNTU-CVE-2026-126070
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
CVE-2026-126070
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
Linux Distros Unpatched Vulnerability : CVE-2026-126070
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags ...
CVE-2026-126070
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
CVE-2026-126070
The Action View framework (prior to versions 8.1.4.1 and 8.0.5.2 ) contains a vulnerability where the strip_tags helper returns sanitized output marked as html_safe. The underlying sanitizer only encodes &, , leaving double and single quotes (`
CVE-2026-126070 Action View: Possible XSS vulnerability in Action View strip_tags
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
CVE-2026-126070 Action View: Possible XSS vulnerability in Action View strip_tags
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
CVE-2026-126070
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, , leaving " and ' unencoded...
PT-2026-144730
Name of the Vulnerable Software and Affected Versions Active Support versions 8.1 through 8.1.4 Description ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer using only its bytes and deserializes it as a new SafeBuffer. This process causes buffers that are no longer html safe? su...
PT-2026-144725
Name of the Vulnerable Software and Affected Versions Action View versions prior to 8.1.4.1 Action View versions prior to 8.0.5.2 Description The strip tags function in Action View returns sanitized output marked as html safe, but the underlying sanitizer only encodes &, , leaving double quotes "...
Zammad WebSocket Session Leak RCE (CVE-2026-102489)
Horizon3 chain for CVE-2026-102489: WebSocket event base triggers NoMethodError leaking connected users Cookie headers; hijacked session installs malicious ERB via packages API and triggers password-reset template evaluation. Blind file output on target default /tmp/zammadrce.txt. !/usr/bin/env...