CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. Resources https://vulners.com/cve/CVE-2016-2098 Usage To use this...

brakeman

Brakeman Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities. Installation Using RubyGems: gem install brakeman Using Bundler: group :development do gem 'brakeman', require: false end Using Docker: docker pull presidentbeef/brakeman Using Docker...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

phishing-frenzy

Phishing Frenzy Ruby on Rails Phishing Framework Documentation & Info Relevant up to date documentation can be found on the official Phishing Frenzy website located below Phishing Frenzy Website Please submit any tickets or issues to the github issues page Phishing Frenzy Tickets To contact us...

CVE-2026-122006

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations e.g., reading secretkeybase because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block...

CVE-2026-122006

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations e.g., reading secretkeybase because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block...

EUVD-2026-116914

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations e.g., reading secretkeybase because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block...

CVE-2026-122006

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations e.g., reading secretkeybase because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block...

CVE-2026-122006

The activestorage gem (versions before 8.1.4.1 ) for Ruby on Rails is vulnerable to unauthorized server read and write operations during ImageMagick attachment processing. The root cause is the execution of the ImageMagick analyzer upon file attachment without a security policy to block unintende...

CVE-2026-122006: rubyonrails Active Storage: The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations e.g., reading secretkeybase because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block...

PT-2026-136974

Name of the Vulnerable Software and Affected Versions activestorage versions prior to 8.0.5.2 activestorage versions prior to 8.1.4.1 Description An issue exists during ImageMagick attachment processing where the analyzer runs when a file is attached. Due to the absence of a restrictive ImageMagi...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

CVE-2024-46987

CVE-2024-46987 – Camaleon CMS Authenticated Path Traversal / Arbitrary File Read CVE-2024-46987 is an authenticated path traversal vulnerability CWE-22 in Camaleon CMS a Ruby on Rails-based content management system. It allows a logged-in user even with low privileges to read arbitrary files on t...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips Arbitrary File Read → SECRETKEYBASE Theft → RCE Overview CVE-2026-66066 is a critical-severity CVSS 9.5 pre-authentication arbitrary file read to remote code execution chain in Ruby on Rails Active Storage, affecting Rails 7.2.0–7.2.3...

heroku-CVE-2013-0333

heroku-CVE-2013-0333 Inspect all of your heroku apps to see if they are running a vulnerable version of Rails Background A serious security vulnerability has been found in the Ruby on Rails framework. This exploit affects nearly all applications running Rails versions 2.3 and 3.0, and a patch has...

dh-CVE_2016_2098

== README Proof of concept for https://groups.google.com/forum/!topic/rubyonrails-security/ly-IH-fxrQ == Exploiting: 1. You should only run rails server in a way that you are certain will not open you up to being exploited 2. Run rails s 3. Execute the following command curl -v -H "Accept:...

CVE-2020-8163

CVE-2020-8163 Enviroment and exploit to CVE-2020-8163 Blind remote code execution of user-provided local names in Rails 5.0.1 and 4.2.11.2 Create the enviroment 1. create docker container mapping port 4000 to 8001 sudo docker run --rm -it -p 8001:4000 ruby:2.3 bash 2. update and install some tool...

railsgoat

RailsGoat RailsGoat is a deliberately vulnerable web application built on Ruby on Rails. It demonstrates real-world security vulnerabilities from the OWASP Top 10 and serves as a hands-on training platform for developers and security professionals. What is RailsGoat? RailsGoat is an intentionally...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method RCE https://nvd.nist.gov/vuln/detail/CVE-2016-2098 Use git clone...