Cross-Site Scripting (XSS)

padrino-contrib is vulnerable to cross-site scripting XSS. The caption parameter in the function sethome of breadcrumbs.rb is not escaped properly to prevent injection of malicious script through it, allowing an attacker to steal session tokens or perform unwanted actions on behalf of the user...