4 matches found
CVE-2017-12098
CVE-2017-12098 is an XSS vulnerability in the rails_admin gem (version 1.2.0) affecting the add filter functionality. A specially crafted URL can cause an attacker to execute arbitrary JavaScript in an authenticated user’s browser (phishing possible). This is documented across multiple sources (N...
CVE-2020-36190
The CVE-2020-36190 case affects the RailsAdmin (rails_admin) gem prior to 1.4.3 and 2.x prior to 2.0.2, exposing a cross-site scripting (XSS) vulnerability via nested forms. Root cause is unvalidated input in nested form handling, enabling injected scripts to be rendered in the browser. The impac...
CVE-2024-39308
CVE-2024-39308 affects RailsAdmin (RailsAdmin list view) with an XSS vulnerability caused by improperly escaped HTML title attributes. The advisory recommends upgrading RailsAdmin to version 3.1.3 or 2.2.2 (to be released) to remediate. The vulnerability is tied to the list view rendering and cou...