CVE-2012-2694

score

<0.1

cvss

4.3

epss

3.9%

published

2012-06-22

kev added

—

first seen

2026-10-21

Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 contain a parameter handling bypass caused by inconsistent handling between Active Record and Rack interface, letting remote attackers bypass database-query restrictions and perform NULL checks via crafted requests, exploit requires sending specific parameter values.