https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 20:22:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196500 EUVD-2026-196500 https://cve.radiocsirt.org/vuln/euvd-2026-196500 https://cve.radiocsirt.org/vuln/fkie_cve-2024-22191 <p>Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim&#39;s browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims&#39; accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.</p> <p>Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim&#39;s browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims&#39; accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-22191 https://cve.radiocsirt.org/vuln/ghsa-ghjv-mh6x-7q6h <p><strong>Affected:</strong> RubyGems: avo</p> <p>### Summary A **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim&#39;s browser.</p> <p>### Details The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.</p> <p>This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.</p> <p>In [avo/fields/common/key_value_component.html.erb]( https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33) the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**.</p> <p>### PoC</p> <p></p> <p>To reproduce the vulnerability, follow these steps:</p> <p>1. Edit an entry with a key_value field. 2. Enter the following payload into the value field: ```POC\&#34;&gt; &lt;script&gt;alert( &#39;XSS in key_value&#39; );&lt;/script&gt; &lt;strong&gt;Outside-tag&lt;/strong``` 3. Save the entry. 4. Go to the index page and click on the eye icon next to the entry.</p> <p>The malicious JavaScript code will be executed and an alert box will be displayed. _On the show and e…</p> <p><strong>Affected:</strong> RubyGems: avo</p> <p>### Summary A **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim&#39;s browser.</p> <p>### Details The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.</p> <p>This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.</p> <p>In [avo/fields/common/key_value_component.html.erb]( https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33) the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**.</p> <p>### PoC</p> <p></p> <p>To reproduce the vulnerability, follow these steps:</p> <p>1. Edit an entry with a key_value field. 2. Enter the following payload into the value field: ```POC\&#34;&gt; &lt;script&gt;alert( &#39;XSS in key_value&#39; );&lt;/script&gt; &lt;strong&gt;Outside-tag&lt;/strong``` 3. Save the entry. 4. Go to the index page and click on the eye icon next to the entry.</p> <p>The malicious JavaScript code will be executed and an alert box will be displayed. _On the show and e…</p> https://cve.radiocsirt.org/vuln/ghsa-ghjv-mh6x-7q6h https://cve.radiocsirt.org/vuln/gsd-2024-22191 gsd-2024-22191 https://cve.radiocsirt.org/vuln/gsd-2024-22191