Browse / Ruby on Rails

Ruby on Rails

See its reports on the map

What gets reported to Ruby on Rails

• Cross-site Scripting22
• Code Execution10
• Denial of Service9
• Path Traversal5
• Other weaknesses5
• Information Disclosure5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. 1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizerInformativeCross-site Scripting (XSS) - Generic · medium
   70 votes
2. Path traversal in AcitveStorage, and lead RCEInformativePath Traversal · high
   37 votes
3. Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete FixInformativePath Traversal · high
   30 votes
4. ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754InformativeCross-site Scripting (XSS) - Reflected · medium
   15 votes
5. HTTP Host injection in redirect_to functionInformativeImproper Neutralization of HTTP Headers for Scripting Syntax
   6 votes
6. Regex Injection from request header (Rack::Sendfile, send_file)InformativeCode Injection
   4 votes
7. Changeable model ids on vanilla update can lead to severely bad side-effectsInformativeViolation of Secure Design Principles
   4 votes
8. Prevent XSS when passing a parameter directly into link_to InformativeCross-site Scripting (XSS) - DOM · low
   2 votes