Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

dawnscanner

Dawnscanner - El escáner de seguridad emergente para aplicaciones web Ruby dawn es un escáner de código fuente diseñado para revisar sus aplicaciones web en busca de problemas de seguridad. La herramienta puede escanear aplicaciones web escritas en Ruby y soporta todos los principales frameworks...

heroku-CVE-2013-0156

heroku-CVE-2013-0156 This vulnerability has been supplanted by CVE-2013-0333. See https://groups.google.com/forum/?fromgroups=!topic/rubyonrails-security/1h2DR63ViGo for more details. A replacement for this script, covering CVE-2013-0333, can be found at...

CVE-2026-66066

🚨 CVE-2026-66066 — KindaRails2Shell Pre-Authentication Remote Code Execution RCE in Ruby on Rails Active Storage Educational security research repository for CVE-2026-66066 "KindaRails2Shell". This repository is intended for security research, vulnerability analysis, detection, and defensive...

CVE-2023-23138

ruby-rail-properties CVE-2023-23138 This is a short view of ruby on rails properties misconfiguration sometimes developers forgot to disable this endpoint /rails/info/properties if this endpoint was enabled on the host, that's mean an attacker can see part/all of the following information:...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. It's written in python3, and remember to install the requests library. here is the command. root@kitploit: pip3 install requests...

cve-2019-5420-POC

Rails ActiveSupport Exploit cve-2019-5420 POC consider this to chain CVE-2019-5418! Pairs lovely with CVE-2019-5418! POC Screenshot 🚨 Warning This repository contains a proof-of-concept PoC exploit demonstrating remote code execution RCE in Ruby on Rails applications via...

name_reverser

== Welcome to Rails Rails is a web-application framework that includes everything needed to create database-backed web applications according to the Model-View-Control pattern. This pattern splits the view also called the presentation into "dumb" templates that are primarily responsible for...

cve-2014-0130

== CVE-2014-0130 Test Case Payload : http://site/api/%5C../%5C../%5C../%5C../%5C../CATDIR === Netsparker Detected : https://i.imgur.com/s1vahmj.png == HackerOne 1 - newrelic.com rails directory traversal vuln by droidsec - https://hackerone.com/reports/134032 == Reference 1...

CVE-2019-5418

CVE-2019-5418 sandbox https://groups.google.com/forum/!msg/rubyonrails-security/zRNVOUhKHrg/GmmcVXcmAAAJ initialize root@kitploit: $ git clone https://github.com/takeokunn/CVE-2019-5418 $ cd https://github.com/takeokunn/CVE-2019-5418 $ docker-compose up Usage root@kitploit: $ curl localhost/sandb...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

ruby-RCE-CVE-2019-5420-

Ruby Deserialization CVE-2019-5420 root@kitploit: https://github.com/PenTestical/CVE-2019-5420 References: root@kitploit: 1 Ruby on Rails command execution vulnerability payload implementation process https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and...

Linux Distros Unpatched Vulnerability : CVE-2026-53769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...

phishing-frenzy

Phishing Frenzy Ruby on Rails Phishing Framework Documentation & Info Relevant up to date documentation can be found on the official Phishing Frenzy website located below Phishing Frenzy Website Please submit any tickets or issues to the github issues page Phishing Frenzy Tickets To contact us...

phishing-frenzy

Phishing Frenzy Framework de Phishing en Ruby on Rails Documentación e Información La documentación relevante y actualizada se puede encontrar en el sitio web oficial de Phishing Frenzy que se muestra a continuación Sitio web de Phishing Frenzy Por favor, envía cualquier ticket o incidencia a la...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method RCE https://nvd.nist.gov/vuln/detail/CVE-2016-2098 Use git clone...

CVE-2013-0156

Original Script Reference For more details on the original exploit script, refer to the gist link CVE-2013-0156 CVE-2013-0156 Exploit Script This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploit. You can access the challenge here: PentesterLab -...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Class Input Validation Error Credits Tobias Kraze from makandra an...

CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

CVE-2026-53769 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...