Lucene search

K

Avo-hq Security Vulnerabilities

cve
cve

CVE-2024-22191

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the.....

7.3CVSS

5.3AI Score

0.001EPSS

2024-01-16 10:15 PM
16
cve
cve

CVE-2024-22411

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious....

6.5CVSS

5.1AI Score

0.001EPSS

2024-01-16 10:15 PM
80
cve
cve

CVE-2023-34103

Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...

7.3CVSS

5.2AI Score

0.001EPSS

2023-06-05 11:15 PM
16
cve
cve

CVE-2023-34102

Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes...

8.8CVSS

8.8AI Score

0.002EPSS

2023-06-05 11:15 PM
20