Skip to content
OpenAdvisories

Package · RubyGems

avo

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-53769

    Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy

    Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such a…

    avo-hq avo avo RubyGems
  • Medium 5.3
    CVE-2026-33209

    Avo has a XSS vulnerability on `return_to` param

    Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting (XSS) vulnerability exists in the return_to query parameter used in the avo interface. An attacker can craft a malicious URL that injec…

    avo-hq avo avo RubyGems
  • Medium 6.5
    CVE-2024-22411 Public exploit

    Cross site scripting in Action messages on Avo

    Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appear…

    avo-hq avo avo RubyGems